starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Remote Auth does not sanitize usernames #6632

New Issue
Closed
opened 2025-12-29 19:43:19 +01:00 by adam · 3 comments
adam commented 2025-12-29 19:43:19 +01:00
Owner
Copy Link

Originally created by @D3luxee on GitHub (Jul 6, 2022).

Originally assigned to: @arthanson on GitHub.

NetBox version

v3.2.2

Python version

3.10

Steps to Reproduce

  1. Setup netbox with remote auth based on netbox.authentication.RemoteUserBackend / Header
  2. Auto Create User must be enabled, see configuration example below
  3. Now open netbox and set the define AUTH_HEADER to a username that contains invalid characters like : which is used for example by Google IAP
  4. This creates a new user in netbox, now open the admin interface of netbox and try to change anything in the user (/admin/auth/user/)
  5. The user edit dialog validates the username if you change something, the frontend does not allow saving any changes there because of an invalid character in the username.
REMOTE_AUTH_ENABLED: true
REMOTE_AUTH_BACKEND: "netbox.authentication.RemoteUserBackend"
REMOTE_AUTH_HEADER: "HTTP_X_GOOG_AUTHENTICATED_USER_EMAIL"
REMOTE_AUTH_AUTO_CREATE_USER: true

Expected Behavior

Netbox should sanitize the usernames that are provided via REMOTE_AUTH_HEADER to create valid usernames.

Observed Behavior

Google IAPs headers have a value of: accounts.google.com:example@gmail.com and it creates a new user based on this in netbox.
But the admin dialogs to change or update those user accounts validates the username and rejects any changes because of invalid characters in the username:

Enter a valid username. This value may contain only letters, numbers, and @/./+/-/_ characters.

Originally created by @D3luxee on GitHub (Jul 6, 2022). Originally assigned to: @arthanson on GitHub. ### NetBox version v3.2.2 ### Python version 3.10 ### Steps to Reproduce 1. Setup netbox with remote auth based on netbox.authentication.RemoteUserBackend / Header 2. Auto Create User must be enabled, see configuration example below 3. Now open netbox and set the define AUTH_HEADER to a username that contains invalid characters like `:` which is used for example by Google IAP 4. This creates a new user in netbox, now open the admin interface of netbox and try to change anything in the user (/admin/auth/user/) 5. The user edit dialog validates the username if you change something, the frontend does not allow saving any changes there because of an invalid character in the username. ``` REMOTE_AUTH_ENABLED: true REMOTE_AUTH_BACKEND: "netbox.authentication.RemoteUserBackend" REMOTE_AUTH_HEADER: "HTTP_X_GOOG_AUTHENTICATED_USER_EMAIL" REMOTE_AUTH_AUTO_CREATE_USER: true ``` ### Expected Behavior Netbox should sanitize the usernames that are provided via REMOTE_AUTH_HEADER to create valid usernames. ### Observed Behavior Google IAPs headers have a value of: `accounts.google.com:example@gmail.com` and it creates a new user based on this in netbox. But the admin dialogs to change or update those user accounts validates the username and rejects any changes because of invalid characters in the username: `Enter a valid username. This value may contain only letters, numbers, and @/./+/-/_ characters.`
adam added the type: bugstatus: accepted labels 2025-12-29 19:43:19 +01:00
adam closed this issue 2025-12-29 19:43:19 +01:00
adam commented 2025-12-29 19:43:21 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Jul 6, 2022):

Thank you for opening a bug report. Unfortunately, the information you have provided is not sufficient for someone else to attempt to reproduce the reported behavior. Remember, each bug report must include detailed steps that someone else can follow on a clean, empty NetBox installation to reproduce the exact problem you're experiencing. These instructions should include the creation of any involved objects, any configuration changes, and complete accounting of the actions being taken. Also be sure that your report does not reference data on the public NetBox demo, as that is subject to change at any time by an outside party and cannot be relied upon for bug reports.

@jeremystretch commented on GitHub (Jul 6, 2022): Thank you for opening a bug report. Unfortunately, the information you have provided is not sufficient for someone else to attempt to reproduce the reported behavior. Remember, each bug report must include detailed steps that someone else can follow on a clean, empty NetBox installation to reproduce the exact problem you're experiencing. These instructions should include the creation of any involved objects, any configuration changes, and complete accounting of the actions being taken. Also be sure that your report does not reference data on the public NetBox demo, as that is subject to change at any time by an outside party and cannot be relied upon for bug reports.
adam commented 2025-12-29 19:43:21 +01:00
Author
Owner
Copy Link

@D3luxee commented on GitHub (Jul 7, 2022):

Hi @jeremystretch
i updated the steps to reproduce, bascially the issue is that the remote auth based on the header is able to create users with usernames that are not possible to create via the frontend and therefor youre not able to edit those users via the admin ui.

@D3luxee commented on GitHub (Jul 7, 2022): Hi @jeremystretch i updated the steps to reproduce, bascially the issue is that the remote auth based on the header is able to create users with usernames that are not possible to create via the frontend and therefor youre not able to edit those users via the admin ui.
adam commented 2025-12-29 19:43:21 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Sep 7, 2022):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. NetBox is governed by a small group of core maintainers which means not all opened issues may receive direct feedback. Do not attempt to circumvent this process by "bumping" the issue; doing so will result in its immediate closure and you may be barred from participating in any future discussions. Please see our contributing guide.

@github-actions[bot] commented on GitHub (Sep 7, 2022): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. NetBox is governed by a small group of core maintainers which means not all opened issues may receive direct feedback. **Do not** attempt to circumvent this process by "bumping" the issue; doing so will result in its immediate closure and you may be barred from participating in any future discussions. Please see our [contributing guide](https://github.com/netbox-community/netbox/blob/develop/CONTRIBUTING.md).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: accepted type: bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#6632
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?