starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Don't fetch LDAP user and groups on all API request when FIND_GROUP_PERMS is disabled #5614

New Issue
Closed
opened 2025-12-29 19:30:10 +01:00 by adam · 1 comment
adam commented 2025-12-29 19:30:10 +01:00
Owner
Copy Link

Originally created by @kkthxbye-code on GitHub (Nov 5, 2021).

Originally assigned to: @kkthxbye-code on GitHub.

NetBox version

V3.0.9

Feature type

Change to existing functionality

Proposed functionality

Currently when using the LDAP backend for authentication, the AD is queried on every API request, regardless of other settings and regardless if the user is local or has been created by the LDAP backend. Additionally the LDAP cache built into django-auth-ldap does not function when using populate_user.

As the user is not actually authenticated against the AD when using the API (the token is used), I propose that the local user and it's group assignments are used when FIND_GROUP_PERMISSIONS is disabled.

I have a change ready for pull request if the issue is accepted.

For more info, please see the discussion I created: https://github.com/netbox-community/netbox/discussions/7708

This issue would also partly fix #6926 - it will not fix the caching, but the user who reported the issue is not using FIND_GROUP_PERMISSIONS.

Use case

The end goal is vastly improved API performance when using the LDAP backend in most cases.

The above changes will result in the following changes for users:

Not using the LDAP backend:

No changes

FIND_GROUP_PERMS = True:

No changes

MIRROR_GROUPS = True and FIND_GROUP_PERMS = True:

No changes

MIRROR_GROUPS = True and FIND_GROUP_PERMS = False:

Local user and group assignments will be used when calling the API and the user and groups are never reloaded from the LDAP server during API calls. This means that LDAP users utilizing the API will have to login to the web ui to update group memberships. The change also allows one to use locally created users to call the API with querying the LDAP server.

MIRROR_GROUPS = False and FIND_GROUP_PERMS = False:

The user performing the API request has to be locally assigned groups or have local user object permissions.

Database changes

No database changes

External dependencies

No response

Originally created by @kkthxbye-code on GitHub (Nov 5, 2021). Originally assigned to: @kkthxbye-code on GitHub. ### NetBox version V3.0.9 ### Feature type Change to existing functionality ### Proposed functionality Currently when using the LDAP backend for authentication, the AD is queried on every API request, regardless of other settings and regardless if the user is local or has been created by the LDAP backend. Additionally the LDAP cache built into django-auth-ldap does not function when using populate_user. As the user is not actually authenticated against the AD when using the API (the token is used), I propose that the local user and it's group assignments are used when FIND_GROUP_PERMISSIONS is disabled. I have a change ready for pull request if the issue is accepted. For more info, please see the discussion I created: https://github.com/netbox-community/netbox/discussions/7708 This issue would also partly fix #6926 - it will not fix the caching, but the user who reported the issue is not using FIND_GROUP_PERMISSIONS. ### Use case The end goal is vastly improved API performance when using the LDAP backend in most cases. The above changes will result in the following changes for users: **Not using the LDAP backend:** No changes **FIND_GROUP_PERMS = True:** No changes **MIRROR_GROUPS = True and FIND_GROUP_PERMS = True:** No changes **MIRROR_GROUPS = True and FIND_GROUP_PERMS = False:** Local user and group assignments will be used when calling the API and the user and groups are never reloaded from the LDAP server during API calls. This means that LDAP users utilizing the API will have to login to the web ui to update group memberships. The change also allows one to use locally created users to call the API with querying the LDAP server. **MIRROR_GROUPS = False and FIND_GROUP_PERMS = False:** The user performing the API request has to be locally assigned groups or have local user object permissions. ### Database changes No database changes ### External dependencies _No response_
adam added the status: acceptedtype: feature labels 2025-12-29 19:30:10 +01:00
adam closed this issue 2025-12-29 19:30:10 +01:00
adam commented 2025-12-29 19:30:11 +01:00
Author
Owner
Copy Link

@kkthxbye-code commented on GitHub (Nov 23, 2021):

I missed the changed labels, I'll retest my proposed solution and make a PR. You can assign me as owner.

@kkthxbye-code commented on GitHub (Nov 23, 2021): I missed the changed labels, I'll retest my proposed solution and make a PR. You can assign me as owner.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: accepted type: feature
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#5614
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?