starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Add the ability to check if a user is a superuser to the API #6143

New Issue
Closed
opened 2025-12-29 19:37:17 +01:00 by adam · 8 comments
adam commented 2025-12-29 19:37:17 +01:00
Owner
Copy Link

Originally created by @jschewebbn on GitHub (Feb 24, 2022).

NetBox version

v3.1.7

Feature type

New functionality

Proposed functionality

The REST API exposes is_staff and is_active, but not is_superuser.

Use case

I would like my webhook scripts to be able to check if the user making a change is a superuser. The particular case is that I want to prevent the Tenant of an IP address from being changed, unless it's done by a superuser. It doesn't appear that the permissions model supports this type of permission, so my webhook is doing the check and reverting the change.

Database changes

No response

External dependencies

No response

Originally created by @jschewebbn on GitHub (Feb 24, 2022). ### NetBox version v3.1.7 ### Feature type New functionality ### Proposed functionality The REST API exposes is_staff and is_active, but not is_superuser. ### Use case I would like my webhook scripts to be able to check if the user making a change is a superuser. The particular case is that I want to prevent the Tenant of an IP address from being changed, unless it's done by a superuser. It doesn't appear that the permissions model supports this type of permission, so my webhook is doing the check and reverting the change. ### Database changes _No response_ ### External dependencies _No response_
adam added the type: featurepending closurestatus: under review labels 2025-12-29 19:37:17 +01:00
adam closed this issue 2025-12-29 19:37:17 +01:00
adam commented 2025-12-29 19:37:18 +01:00
Author
Owner
Copy Link

@sdktr commented on GitHub (Mar 3, 2022):

Isn't your actual question: how can I prevent a tenant update on ipaddress in the RBAC?

@sdktr commented on GitHub (Mar 3, 2022): Isn't your actual question: how can I prevent a tenant update on ipaddress in the RBAC?
adam commented 2025-12-29 19:37:18 +01:00
Author
Owner
Copy Link

@jschewebbn commented on GitHub (Mar 3, 2022):

I suppose I really have 2 questions:

  1. Using the API I can query for is_active and is_staff, why can't I query for is_superuser?

  2. Is there a way to configure the RBAC to not allow the tenant of an IP address to be changed, but other aspects of the IP address can be changed?

@jschewebbn commented on GitHub (Mar 3, 2022): I suppose I really have 2 questions: 1) Using the API I can query for is_active and is_staff, why can't I query for is_superuser? 2) Is there a way to configure the RBAC to not allow the tenant of an IP address to be changed, but other aspects of the IP address can be changed?
adam commented 2025-12-29 19:37:18 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Mar 7, 2022):

  1. Using the API I can query for is_active and is_staff, why can't I query for is_superuser?

When the users endpoint of the REST API was implemented, it did not seem prudent to expose this, and arguably still doesn't.

  1. Is there a way to configure the RBAC to not allow the tenant of an IP address to be changed, but other aspects of the IP address can be changed?

You can create permission constraints that limit the assigned tenant to a specific value or set of values, but it is not possible to restrict changing only a specific field.

@jeremystretch commented on GitHub (Mar 7, 2022): > 1. Using the API I can query for is_active and is_staff, why can't I query for is_superuser? When the users endpoint of the REST API was implemented, it did not seem prudent to expose this, and arguably still doesn't. > 2. Is there a way to configure the RBAC to not allow the tenant of an IP address to be changed, but other aspects of the IP address can be changed? You can create permission constraints that limit the assigned tenant to a specific value or set of values, but it is not possible to restrict changing only a specific field.
adam commented 2025-12-29 19:37:18 +01:00
Author
Owner
Copy Link

@jschewebbn commented on GitHub (Mar 7, 2022):

  1. Using the API I can query for is_active and is_staff, why can't I query for is_superuser?

When the users endpoint of the REST API was implemented, it did not seem prudent to expose this, and arguably still doesn't.

Due to not having the ability to limit the editing of a single field, I'd like to be able to have my webhook be able to determine if the change was made by a superuser. If it was, then the change is valid, if it was not, then the webhook can revert the change.

@jschewebbn commented on GitHub (Mar 7, 2022): > > 1. Using the API I can query for is_active and is_staff, why can't I query for is_superuser? > > When the users endpoint of the REST API was implemented, it did not seem prudent to expose this, and arguably still doesn't. Due to not having the ability to limit the editing of a single field, I'd like to be able to have my webhook be able to determine if the change was made by a superuser. If it was, then the change is valid, if it was not, then the webhook can revert the change.
adam commented 2025-12-29 19:37:18 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Mar 7, 2022):

Why are you tying it to superuser status? A superuser, by definition, has all permissions, so you don't typically want to enable this for regular users. Why not instead create a custom permission, and check whether the user has that permission assigned?

@jeremystretch commented on GitHub (Mar 7, 2022): Why are you tying it to superuser status? A superuser, by definition, has _all_ permissions, so you don't typically want to enable this for regular users. Why not instead create a custom permission, and check whether the user has that permission assigned?
adam commented 2025-12-29 19:37:19 +01:00
Author
Owner
Copy Link

@jschewebbn commented on GitHub (Mar 7, 2022):

I think of the superuser status as a group and those individuals should have this ability.
If that doesn't work, then creating a separate group would work. A permission seems odd given that it's not really protecting any particular object.

@jschewebbn commented on GitHub (Mar 7, 2022): I think of the superuser status as a group and those individuals should have this ability. If that doesn't work, then creating a separate group would work. A permission seems odd given that it's not really protecting any particular object.
adam commented 2025-12-29 19:37:19 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (May 7, 2022):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. NetBox is governed by a small group of core maintainers which means not all opened issues may receive direct feedback. Please see our contributing guide.

@github-actions[bot] commented on GitHub (May 7, 2022): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. NetBox is governed by a small group of core maintainers which means not all opened issues may receive direct feedback. Please see our [contributing guide](https://github.com/netbox-community/netbox/blob/develop/CONTRIBUTING.md).
adam commented 2025-12-29 19:37:20 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Jun 6, 2022):

This issue has been automatically closed due to lack of activity. In an effort to reduce noise, please do not comment any further. Note that the core maintainers may elect to reopen this issue at a later date if deemed necessary.

@github-actions[bot] commented on GitHub (Jun 6, 2022): This issue has been automatically closed due to lack of activity. In an effort to reduce noise, please do not comment any further. Note that the core maintainers may elect to reopen this issue at a later date if deemed necessary.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label pending closure status: under review type: feature
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#6143
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?