starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Hybrid remote/preauth authentication + LDAP authorization #4121

New Issue
Closed
opened 2025-12-29 18:33:15 +01:00 by adam · 6 comments
adam commented 2025-12-29 18:33:15 +01:00
Owner
Copy Link

Originally created by @bluikko on GitHub (Sep 20, 2020).

Environment

  • Python version: 3.6.8
  • NetBox version: 2.9.3

Proposed Functionality

Allow using remote/preauth for authentication while still using LDAP for authorization.

The user is authenticated by the web server similarly to current remote authentication. But then, additionally, the user name is used to do an LDAP search to resolve group memberships for authorization. Basically a hybrid of current remote authentication and current LDAP authentication.

A proof of concept exists (by sly-net) at https://github.com/sly-net/netbox-remote-authn-ldap-authz

Use Case

Cases where the web server authenticates the user, usually with SSO such as GSSAPI/OAuth, and authorization for access control to different user classes is needed.

Database Changes

Looking at the PoC it could be implemented without DB changes but I could not say if that is a good way.

External Dependencies

No new dependencies.

Originally created by @bluikko on GitHub (Sep 20, 2020). <!-- NOTE: IF YOUR ISSUE DOES NOT FOLLOW THIS TEMPLATE, IT WILL BE CLOSED. This form is only for proposing specific new features or enhancements. If you have a general idea or question, please post to our mailing list instead of opening an issue: https://groups.google.com/forum/#!forum/netbox-discuss NOTE: Due to an excessive backlog of feature requests, we are not currently accepting any proposals which significantly extend NetBox's feature scope. Please describe the environment in which you are running NetBox. Be sure that you are running an unmodified instance of the latest stable release before submitting a bug report. --> ### Environment * Python version: 3.6.8 * NetBox version: 2.9.3 <!-- Describe in detail the new functionality you are proposing. Include any specific changes to work flows, data models, or the user interface. --> ### Proposed Functionality Allow using remote/preauth for authentication while still using LDAP for authorization. The user is authenticated by the web server similarly to current remote authentication. But then, additionally, the user name is used to do an LDAP search to resolve group memberships for authorization. Basically a hybrid of current remote authentication and current LDAP authentication. A proof of concept exists (by `sly-net`) at https://github.com/sly-net/netbox-remote-authn-ldap-authz <!-- Convey an example use case for your proposed feature. Write from the perspective of a NetBox user who would benefit from the proposed functionality and describe how. ---> ### Use Case Cases where the web server authenticates the user, usually with SSO such as GSSAPI/OAuth, and authorization for access control to different user classes is needed. <!-- Note any changes to the database schema necessary to support the new feature. For example, does the proposal require adding a new model or field? (Not all new features require database changes.) ---> ### Database Changes Looking at the PoC it could be implemented without DB changes but I could not say if that is a good way. <!-- List any new dependencies on external libraries or services that this new feature would introduce. For example, does the proposal require the installation of a new Python package? (Not all new features introduce new dependencies.) --> ### External Dependencies No new dependencies.
adam added the pending closure label 2025-12-29 18:33:15 +01:00
adam closed this issue 2025-12-29 18:33:15 +01:00
adam commented 2025-12-29 18:33:16 +01:00
Author
Owner
Copy Link

@lampwins commented on GitHub (Sep 26, 2020):

Please explain the exact change you are proposing to the core of NetBox and why this cannot be achieved today using a custom auth backend and/or plugin.

@lampwins commented on GitHub (Sep 26, 2020): Please explain the exact change you are proposing to the core of NetBox and why this cannot be achieved today using a custom auth backend and/or plugin.
adam commented 2025-12-29 18:33:16 +01:00
Author
Owner
Copy Link

@bluikko commented on GitHub (Sep 26, 2020):

I am not familiar enough with the NetBox source to explain how core of NetBox would need to be changed. I guess there would not be much changes. The remote authentication exists already and the LDAP authentication exists as well. The problem is that users' groups in LDAP (which would be the authorization part) are not available currently when remote authentication is used.

I suppose it could be achieved with auth backend and/or plug-in. The PoC at https://github.com/sly-net/netbox-remote-authn-ldap-authz is not clear to me but it looks like it is exactly an authentication plug-in.

@bluikko commented on GitHub (Sep 26, 2020): I am not familiar enough with the NetBox source to explain how core of NetBox would need to be changed. I guess there would not be much changes. The remote authentication exists already and the LDAP authentication exists as well. The problem is that users' groups in LDAP (which would be the authorization part) are not available currently when remote authentication is used. I suppose it could be achieved with auth backend and/or plug-in. The PoC at https://github.com/sly-net/netbox-remote-authn-ldap-authz is not clear to me but it looks like it is exactly an authentication plug-in.
adam commented 2025-12-29 18:33:16 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Sep 28, 2020):

This sounds like functionality that belongs in a plugin, particularly given the complexity involved.

@jeremystretch commented on GitHub (Sep 28, 2020): This sounds like functionality that belongs in a plugin, particularly given the complexity involved.
adam commented 2025-12-29 18:33:16 +01:00
Author
Owner
Copy Link

@bluikko commented on GitHub (Sep 29, 2020):

My opinion on this from system administrator point of view (having worked on authentication/authorization on numerous web apps): the web server will always be much more flexible in authenticating the user. But authorization has to be done at the web app. This is why so many web apps separate authentication and authorization cleanly.

Edit: I forgot attribution in my OP. The PoC is not my code, it is from another issue by sly-net.

@bluikko commented on GitHub (Sep 29, 2020): My opinion on this from system administrator point of view (having worked on authentication/authorization on numerous web apps): the web server will always be much more flexible in authenticating the user. But authorization has to be done at the web app. This is why so many web apps separate authentication and authorization cleanly. Edit: I forgot attribution in my OP. The PoC is not my code, it is from another issue by `sly-net`.
adam commented 2025-12-29 18:33:16 +01:00
Author
Owner
Copy Link

@stale[bot] commented on GitHub (Nov 14, 2020):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. NetBox is governed by a small group of core maintainers which means not all opened issues may receive direct feedback. Please see our contributing guide.

@stale[bot] commented on GitHub (Nov 14, 2020): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. NetBox is governed by a small group of core maintainers which means not all opened issues may receive direct feedback. Please see our [contributing guide](https://github.com/netbox-community/netbox/blob/develop/CONTRIBUTING.md).
adam commented 2025-12-29 18:33:16 +01:00
Author
Owner
Copy Link

@stale[bot] commented on GitHub (Nov 29, 2020):

This issue has been automatically closed due to lack of activity. In an effort to reduce noise, please do not comment any further. Note that the core maintainers may elect to reopen this issue at a later date if deemed necessary.

@stale[bot] commented on GitHub (Nov 29, 2020): This issue has been automatically closed due to lack of activity. In an effort to reduce noise, please do not comment any further. Note that the core maintainers may elect to reopen this issue at a later date if deemed necessary.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label pending closure
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#4121
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?