starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Field-Level Permissions for Object Access #11051

New Issue
Closed
opened 2025-12-29 21:39:39 +01:00 by adam · 1 comment
adam commented 2025-12-29 21:39:39 +01:00
Owner
Copy Link

Originally created by @jonasnieberle on GitHub (Apr 17, 2025).

NetBox version

v4.2.7

Feature type

Data model extension

Proposed functionality

Currently, NetBox allows permissions to be assigned at the object level using the existing ObjectPermission model.
For example, a user can be granted the view action on the IPAM > VLANs object, which gives access to the entire object.
This feature proposes extending the permission system to support field-level access control within objects. This means that actions like view or change can be scoped not just to a model, but to specific fields within that model.

For example, an admin could configure a permission such that a user can:
Only view the site, name, and description fields of a VLAN.
Be restricted from viewing or editing other fields such as vid, tenant, status, or role.

The implementation could build on the current ObjectPermission model by adding a fields attribute that lists the allowed fields for that permission.
If no fields are defined, behavior would fall back to current full-object access.

Changes would also need to be reflected in:

  • Serializers: to exclude or redact unauthorized fields in API responses.
  • UI templates/forms: to hide or disable fields the user lacks permission to view or edit.
  • Validation logic: to prevent submission of unauthorized field changes.

I only find the following discussion about the topic: https://github.com/netbox-community/netbox/discussions/15448

Use case

NetBox is used by multiple teams with different responsibilities and levels of data sensitivity. For example, a field technician might need to look up VLAN information when working at a site but only requires access to high-level fields like location and description. They should not be able to see or modify sensitive fields such as VLAN ID, tenant, or status.

By introducing field-level permissions:

  • Teams get tailored access aligned with their responsibilities.
  • Sensitive information is protected and only visible to authorized roles.
  • The user interface becomes cleaner and less cluttered for users with limited scope.
  • It enables implementation of least privilege and data minimization policies.

Database changes

This feature could be implemented by extending the existing ObjectPermission model to include an optional fields attribute (e.g., a list of field names the permission applies to). No entirely new models would be required.

External dependencies

No response

Originally created by @jonasnieberle on GitHub (Apr 17, 2025). ### NetBox version v4.2.7 ### Feature type Data model extension ### Proposed functionality Currently, NetBox allows permissions to be assigned at the object level using the existing ObjectPermission model. For example, a user can be granted the view action on the IPAM > VLANs object, which gives access to the entire object. This feature proposes extending the permission system to support field-level access control within objects. This means that actions like view or change can be scoped not just to a model, but to specific fields within that model. For example, an admin could configure a permission such that a user can: Only view the site, name, and description fields of a VLAN. Be restricted from viewing or editing other fields such as vid, tenant, status, or role. The implementation could build on the current ObjectPermission model by adding a fields attribute that lists the allowed fields for that permission. If no fields are defined, behavior would fall back to current full-object access. Changes would also need to be reflected in: - Serializers: to exclude or redact unauthorized fields in API responses. - UI templates/forms: to hide or disable fields the user lacks permission to view or edit. - Validation logic: to prevent submission of unauthorized field changes. I only find the following discussion about the topic: https://github.com/netbox-community/netbox/discussions/15448 ### Use case NetBox is used by multiple teams with different responsibilities and levels of data sensitivity. For example, a field technician might need to look up VLAN information when working at a site but only requires access to high-level fields like location and description. They should not be able to see or modify sensitive fields such as VLAN ID, tenant, or status. By introducing field-level permissions: - Teams get tailored access aligned with their responsibilities. - Sensitive information is protected and only visible to authorized roles. - The user interface becomes cleaner and less cluttered for users with limited scope. - It enables implementation of least privilege and data minimization policies. ### Database changes This feature could be implemented by extending the existing ObjectPermission model to include an optional fields attribute (e.g., a list of field names the permission applies to). No entirely new models would be required. ### External dependencies _No response_
adam added the type: feature label 2025-12-29 21:39:39 +01:00
adam closed this issue 2025-12-29 21:39:39 +01:00
adam commented 2025-12-29 21:39:40 +01:00
Author
Owner
Copy Link

@arthanson commented on GitHub (Apr 17, 2025):

Thank you for submitting your idea. Unfortunately, the proposed feature falls outside the scope of functionality that NetBox aims to provide. As NetBox is an open source application with limited development resources and a persistent backlog of existing work, it is crucial that we limit the scope of development to ensure it remains a maintainable project for many years to come. Thank you for your understanding.

If you want to look into this more, please go ahead and put together a proof of concept and we can take a look at it.

@arthanson commented on GitHub (Apr 17, 2025): Thank you for submitting your idea. Unfortunately, the proposed feature falls outside the scope of functionality that NetBox aims to provide. As NetBox is an open source application with limited development resources and a persistent backlog of existing work, it is crucial that we limit the scope of development to ensure it remains a maintainable project for many years to come. Thank you for your understanding. If you want to look into this more, please go ahead and put together a proof of concept and we can take a look at it.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label type: feature
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#11051
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?