starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

API user impersonation #6056

New Issue
Closed
opened 2025-12-29 19:36:10 +01:00 by adam · 2 comments
adam commented 2025-12-29 19:36:10 +01:00
Owner
Copy Link

Originally created by @steffenschumacher on GitHub (Feb 6, 2022).

NetBox version

v3.1.5

Feature type

Change to existing functionality

Proposed functionality

Allow user impersonation for api requests.
Using an http header attribute, eg. “impersonate”=“some-user” along with the api token, and if the user owning the api token is authorized to impersonate users, then the request is authenticated as “some-user” if this user exists.
Furthermore, if an http attribute “impersonate_authorization” is “false”, then the privileges of this request will be those of the api token owner instead of the impersonated user.

Use case

We have a front end system is issuing requests to netbox for users in a assisted fashion, and we would like the front end to do write operations on behalf of users we don’t want to grant write access to netbox for.

Database changes

None I think?

External dependencies

None?

Originally created by @steffenschumacher on GitHub (Feb 6, 2022). ### NetBox version v3.1.5 ### Feature type Change to existing functionality ### Proposed functionality Allow user impersonation for api requests. Using an http header attribute, eg. “impersonate”=“some-user” along with the api token, and if the user owning the api token is authorized to impersonate users, then the request is authenticated as “some-user” if this user exists. Furthermore, if an http attribute “impersonate_authorization” is “false”, then the privileges of this request will be those of the api token owner instead of the impersonated user. ### Use case We have a front end system is issuing requests to netbox for users in a assisted fashion, and we would like the front end to do write operations on behalf of users we don’t want to grant write access to netbox for. ### Database changes None I think? ### External dependencies None?
adam added the type: feature label 2025-12-29 19:36:10 +01:00
adam closed this issue 2025-12-29 19:36:10 +01:00
adam commented 2025-12-29 19:36:11 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Feb 7, 2022):

User identity is inferred from the token being used, so it wouldn't make sense to override this. Rather, you can just use a token belonging to the desired user. Your front end can leverage automatic token provisioning for any users that cannot supply their own API token.

@jeremystretch commented on GitHub (Feb 7, 2022): User identity is inferred from the token being used, so it wouldn't make sense to override this. Rather, you can just use a token belonging to the desired user. Your front end can leverage [automatic token provisioning](https://netbox.readthedocs.io/en/stable/rest-api/authentication/#initial-token-provisioning) for any users that cannot supply their own API token.
adam commented 2025-12-29 19:36:11 +01:00
Author
Owner
Copy Link

@steffenschumacher commented on GitHub (Feb 7, 2022):

@jeremystretch
Ok, so when it’s acceptable to grant users the same privileges in netbox as in the front end system, then I agree with our outlined solution.
I guess I weren’t too clear, and I’ll also admit that it’s absolutely a corner case, but I’d like to:

  • allow users to do write operations via the front end system, since it controls how it’s done, and does it automated..
  • I don’t want them changing stuff directly in netbox, as they are humans.
  • yet I want their id in the change logs in netbox of the objects changed via the front end system

The issue with using tokens of the netbox users, would be that the privileges of the users in netbox would need to include write access, which I don’t want them to have..

so is this out of the question, or should I refactor/trim the issue to my specific use case?

@steffenschumacher commented on GitHub (Feb 7, 2022): @jeremystretch Ok, so when it’s acceptable to grant users the same privileges in netbox as in the front end system, then I agree with our outlined solution. I guess I weren’t too clear, and I’ll also admit that it’s absolutely a corner case, but I’d like to: - allow users to do write operations via the front end system, since it controls how it’s done, and does it automated.. - I don’t want them changing stuff directly in netbox, as they are humans. - yet I want their id in the change logs in netbox of the objects changed via the front end system The issue with using tokens of the netbox users, would be that the privileges of the users *in* netbox would need to include write access, which I don’t want them to have.. so is this out of the question, or should I refactor/trim the issue to my specific use case?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label type: feature
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#6056
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?