starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Improve multitenancy support #11502

New Issue
Closed
opened 2025-12-29 21:46:04 +01:00 by adam · 2 comments
adam commented 2025-12-29 21:46:04 +01:00
Owner
Copy Link

Originally created by @chaeynz on GitHub (Aug 19, 2025).

NetBox version

v4.3.6

Feature type

Change to existing functionality

Proposed functionality

Hi there! :3
We would like to use Netbox to give users access to their own silo of Netbox data.
The current way how Netbox addresses the concept of tenancy is not enough for that I believe and therefore I would like to suggest an improvement in how Netbox handles this.

Basically, when I create a tenant in Netbox, there is no clear way for me to assign a user to that tenant.
I would want to limit the user to be within the scope of this tenant, along with any objects that user creates.
Right now, when I use Netbox permissions to limit access rights to only objects from a specific Tenant, the user can still accidently create an object without a tenant assigned.

I would suggest the following:

  • Add field for the user object to assign a list of tenants to a user object (as a simpler way, basically a wrapper to the permissions, to give a user view rights to that tenant and prevent the user from viewing any objects outside that tenant) - basically a multiselect dropdown in the UI
  • Add field for user to specify a single tenant, every time the user creates an object, Netbox will check for the users "default_tenant" field and ensure the object has that tenant assigned

I would love to hear your input!

Use case

We want to be able to for example spin up demo environments for users, where they get their own silo of data in netbox and can use the automation that was configured beforehand.
In the slack I asked about something similar related to multitenancy before and it was suggested to just install multiple instances of netbox.
This is not an option though.

Database changes

New fields in the User model:

  • tenants
  • default_tenant

External dependencies

No response

Originally created by @chaeynz on GitHub (Aug 19, 2025). ### NetBox version v4.3.6 ### Feature type Change to existing functionality ### Proposed functionality Hi there! :3 We would like to use Netbox to give users access to their own silo of Netbox data. The current way how Netbox addresses the concept of tenancy is not enough for that I believe and therefore I would like to suggest an improvement in how Netbox handles this. Basically, when I create a tenant in Netbox, there is no clear way for me to assign a user to that tenant. I would want to limit the user to be within the scope of this tenant, along with any objects that user creates. Right now, when I use Netbox permissions to limit access rights to only objects from a specific Tenant, the user can still accidently create an object without a tenant assigned. I would suggest the following: - Add field for the user object to assign a list of tenants to a user object (as a simpler way, basically a wrapper to the permissions, to give a user view rights to that tenant and prevent the user from viewing any objects outside that tenant) - basically a multiselect dropdown in the UI - Add field for user to specify a single tenant, every time the user creates an object, Netbox will check for the users "default_tenant" field and ensure the object has that tenant assigned I would love to hear your input! ### Use case We want to be able to for example spin up demo environments for users, where they get their own silo of data in netbox and can use the automation that was configured beforehand. In the slack I asked about something similar related to multitenancy before and it was suggested to just install multiple instances of netbox. This is not an option though. ### Database changes New fields in the User model: - tenants - default_tenant ### External dependencies _No response_
adam added the type: feature label 2025-12-29 21:46:04 +01:00
adam closed this issue 2025-12-29 21:46:04 +01:00
adam commented 2025-12-29 21:46:05 +01:00
Author
Owner
Copy Link

@sleepinggenius2 commented on GitHub (Aug 19, 2025):

We already do this today in our environment to segregate permissions by department using permission constraints. We have a group for each department and can assign a user to the appropriate group to get those permissions. Some users are members of multiple tenants and thus multiple groups. The default tenant is an interesting idea, but would potentially only help in auto-populating the tenant dropdown, as you can already use permission constraints to limit what tenants a user can select from. To address your concern about creating objects without a tenant assigned, that can be solved with custom validators that makes tenant a required field on the objects where you need it. Technically, you could also use that method to achieve your default tenant. Unfortunately, it doesn't look like the User or Group models currently support custom fields, so you would need to maintain that mapping elsewhere, potentially in Custom Objects once that goes GA? I would personally be interested in an FR to add support for custom fields (and tags would also be nice) to the User and Group models.

@sleepinggenius2 commented on GitHub (Aug 19, 2025): We already do this today in our environment to segregate permissions by department using permission constraints. We have a group for each department and can assign a user to the appropriate group to get those permissions. Some users are members of multiple tenants and thus multiple groups. The default tenant is an interesting idea, but would potentially only help in auto-populating the tenant dropdown, as you can already use permission constraints to limit what tenants a user can select from. To address your concern about creating objects without a tenant assigned, that can be solved with custom validators that makes tenant a required field on the objects where you need it. Technically, you could also use that method to achieve your default tenant. Unfortunately, it doesn't look like the User or Group models currently support custom fields, so you would need to maintain that mapping elsewhere, potentially in Custom Objects once that goes GA? I would personally be interested in an FR to add support for custom fields (and tags would also be nice) to the User and Group models.
adam commented 2025-12-29 21:46:05 +01:00
Author
Owner
Copy Link

@jnovinger commented on GitHub (Aug 21, 2025):

Thanks for the feature request, @chaeynz . What you're asking for is a multi-tenancy solution for users, which is not what the Tenant model is for. Tenants represent "a discrete grouping of resources used for administrative purposes" like customers or departments, not user access control. The idea of user data isolation is potentially worthwhile, but this approach would conflate resource tenancy (organizing infrastructure by ownership) with user tenancy (isolating user access), breaking the current model for existing users.

@jnovinger commented on GitHub (Aug 21, 2025): Thanks for the feature request, @chaeynz . What you're asking for is a multi-tenancy solution for users, which is not what the [Tenant model is for](https://netboxlabs.com/docs/netbox/en/stable/features/tenancy/). Tenants represent "a discrete grouping of resources used for administrative purposes" like customers or departments, not user access control. The idea of user data isolation is potentially worthwhile, but this approach would conflate resource tenancy (organizing infrastructure by ownership) with user tenancy (isolating user access), breaking the current model for existing users.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label type: feature
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#11502
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?