starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Implement two factor authentication #82

New Issue
Closed
opened 2025-12-29 15:31:56 +01:00 by adam · 14 comments
adam commented 2025-12-29 15:31:56 +01:00
Owner
Copy Link

Originally created by @mdlayher on GitHub (Jun 29, 2016).

It would be a great added security measure to allow two factor authentication using a smartphone application like Google Authenticator.

Originally created by @mdlayher on GitHub (Jun 29, 2016). It would be a great added security measure to allow two factor authentication using a smartphone application like Google Authenticator.
adam closed this issue 2025-12-29 15:31:56 +01:00
adam commented 2025-12-29 15:31:57 +01:00
Author
Owner
Copy Link

@bellwood commented on GitHub (Jun 29, 2016):

Can I request U2F FIDO?

https://www.yubico.com/about/background/fido/

@bellwood commented on GitHub (Jun 29, 2016): Can I request U2F FIDO? https://www.yubico.com/about/background/fido/
adam commented 2025-12-29 15:31:57 +01:00
Author
Owner
Copy Link

@x-zeroflux-x commented on GitHub (Jun 30, 2016):

Google Auth for us would be a great addition as well :)

@x-zeroflux-x commented on GitHub (Jun 30, 2016): Google Auth for us would be a great addition as well :)
adam commented 2025-12-29 15:31:57 +01:00
Author
Owner
Copy Link

@ryanmerolle commented on GitHub (Jun 30, 2016):

Adding some notes if this enhancement is put on the roadmap:
https://developers.google.com/api-client-library/python/guide/django

@ryanmerolle commented on GitHub (Jun 30, 2016): Adding some notes if this enhancement is put on the roadmap: https://developers.google.com/api-client-library/python/guide/django
adam commented 2025-12-29 15:31:58 +01:00
Author
Owner
Copy Link

@bellwood commented on GitHub (Jul 6, 2016):

Note for U2F:

https://developers.yubico.com/U2F/Plugins.html

https://github.com/gavinwahl/django-u2f

@bellwood commented on GitHub (Jul 6, 2016): Note for U2F: https://developers.yubico.com/U2F/Plugins.html https://github.com/gavinwahl/django-u2f
adam commented 2025-12-29 15:31:58 +01:00
Author
Owner
Copy Link

@MaXFalstein commented on GitHub (Jul 11, 2016):

There should be no reason why the user cannot select which type of extra level of authentication they wish to use.

This could be set enabled in the python script, which means you could have them tiered where you could use all three if you have some military grade requirements.

For the normal NetBox user, one of the two above listed solutions would be fine.

Some people will want to use Google Authenticator, some people will want to use U2F FIDO and some people will want to use alternatives, such as SoundLogin, HDE ODP and Authenticator Plus to name the good few in a range of underwhelming authenticators - gimmicks are everywhere.

@MaXFalstein commented on GitHub (Jul 11, 2016): There should be no reason why the user cannot select which type of extra level of authentication they wish to use. > This could be set enabled in the python script, which means you could have them tiered where you could use all three if you have some military grade requirements. For the normal NetBox user, one of the two above listed solutions would be fine. Some people will want to use **Google Authenticator**, some people will want to use **U2F FIDO** and some people will want to use alternatives, such as **[SoundLogin](https://www.soundlogin.com/)**, **HDE ODP** and **Authenticator Plus** to name the good few in a range of underwhelming authenticators - gimmicks are everywhere.
adam commented 2025-12-29 15:31:59 +01:00
Author
Owner
Copy Link

@jsenecal commented on GitHub (Sep 15, 2016):

I would suggest this as a way to implement one-time-passwords:
https://django-two-factor-auth.readthedocs.io/en/stable/

@jsenecal commented on GitHub (Sep 15, 2016): I would suggest this as a way to implement one-time-passwords: https://django-two-factor-auth.readthedocs.io/en/stable/
adam commented 2025-12-29 15:31:59 +01:00
Author
Owner
Copy Link

@specialcircumstances commented on GitHub (Nov 21, 2016):

Perhaps some SAML integration?

@specialcircumstances commented on GitHub (Nov 21, 2016): Perhaps some SAML integration?
adam commented 2025-12-29 15:31:59 +01:00
Author
Owner
Copy Link

@ack-martijng commented on GitHub (Dec 15, 2016):

SAML integration and/or radius integration would work very well.

Radius integration could also enforce twofactor authentication on it's own if the radius client in the Django framework works well (no experience with that).

@ack-martijng commented on GitHub (Dec 15, 2016): SAML integration and/or radius integration would work very well. Radius integration could also enforce twofactor authentication on it's own if the radius client in the Django framework works well (no experience with that).
adam commented 2025-12-29 15:32:00 +01:00
Author
Owner
Copy Link

@hawko2600 commented on GitHub (Dec 16, 2016):

Wouldn't it make more sense to do this in the HTTP server fronting netbox?

Whether you have a F5 LTM in front of your web servers, or you have Apache/Nginx, then a server host like uwsgi or whatever - they can all authenticate clients and pass through (and better still, block before annoying the application (netbox) with an unauthorised connection).

Auth modules are already invented for these layers; Jeremy reinventing the wheel for every auth type just wastes his time.

@hawko2600 commented on GitHub (Dec 16, 2016): Wouldn't it make more sense to do this in the HTTP server fronting netbox? Whether you have a F5 LTM in front of your web servers, or you have Apache/Nginx, then a server host like uwsgi or whatever - they can all authenticate clients and pass through (and better still, block before annoying the application (netbox) with an unauthorised connection). Auth modules are already invented for these layers; Jeremy reinventing the wheel for every auth type just wastes his time.
adam commented 2025-12-29 15:32:00 +01:00
Author
Owner
Copy Link

@ack-martijng commented on GitHub (Dec 16, 2016):

@darthmdh To be honest, i am not so much a developer or a experienced server operator.
I tend to find my way through systems, but i lack sometimes the knowledge to connect two things to each other.

I agree that if this could be done within the webserver, this does not need to be implemented within Netbox. However i would appreciate if Netbox would trust the username passed from the webserver to the cgi for administrative access. So people still do not need to log in again.

Implementing the two factor (or any other) authentication method would mean (from my point of view) it will become almost impossible to maintain a list of every 'edit' page. This is available within Netbox that does enforce the login requirement.
For example adding a addon in the future would not add new edit pages to the list of pages required authorisation within the webserver.
Also i believe we (Jeremy) should not be reinventing the process for every type of authorisation-system. There are a few good standards that are used by large authentication providers. Radius, SAML en LDAP are three of them from my perspective. And there are already Django/Python modules for these available.
If i was able to write those implementations myself i would be happy to collaborate on this, unfortunatly i am not.

@ack-martijng commented on GitHub (Dec 16, 2016): @darthmdh To be honest, i am not so much a developer or a experienced server operator. I tend to find my way through systems, but i lack sometimes the knowledge to connect two things to each other. I agree that if this could be done within the webserver, this does not need to be implemented within Netbox. However i would appreciate if Netbox would trust the username passed from the webserver to the cgi for administrative access. So people still do not need to log in again. Implementing the two factor (or any other) authentication method would mean (from my point of view) it will become almost impossible to maintain a list of every 'edit' page. This is available within Netbox that does enforce the login requirement. For example adding a addon in the future would not add new edit pages to the list of pages required authorisation within the webserver. Also i believe we (Jeremy) should not be reinventing the process for every type of authorisation-system. There are a few good standards that are used by large authentication providers. Radius, SAML en LDAP are three of them from my perspective. And there are already Django/Python modules for these available. If i was able to write those implementations myself i would be happy to collaborate on this, unfortunatly i am not.
adam commented 2025-12-29 15:32:01 +01:00
Author
Owner
Copy Link

@krimdomu commented on GitHub (Apr 12, 2017):

Hi there,

i've read through this thread because i was looking for an adfs integration for netbox. I also searched for adfs/saml addons for nginx and uwsgi but at the end i added the adfs support into netbox, because there are good libs already for django to get this working.

If you want i can create a merge request for this. The code can be found here: 795d3971dd

@krimdomu commented on GitHub (Apr 12, 2017): Hi there, i've read through this thread because i was looking for an adfs integration for netbox. I also searched for adfs/saml addons for nginx and uwsgi but at the end i added the adfs support into netbox, because there are good libs already for django to get this working. If you want i can create a merge request for this. The code can be found here: https://github.com/inovex/netbox/commit/795d3971dd527bdb4ae48bd392cd7750555a1a37
adam commented 2025-12-29 15:32:09 +01:00
Author
Owner
Copy Link

@callumbnz commented on GitHub (Jul 17, 2017):

Would be nice if netbox played nice with something like Okta which is basicallum SAML2 - i see someone has already built a plugin for Django/SAML

https://github.com/fangli/django-saml2-auth

How hard would that be to integrate?

@callumbnz commented on GitHub (Jul 17, 2017): Would be nice if netbox played nice with something like Okta which is basicallum SAML2 - i see someone has already built a plugin for Django/SAML https://github.com/fangli/django-saml2-auth How hard would that be to integrate?
adam commented 2025-12-29 15:32:10 +01:00
Author
Owner
Copy Link

@rhys-intelliflo commented on GitHub (Oct 5, 2017):

any progress with the SAML2 integration?

@rhys-intelliflo commented on GitHub (Oct 5, 2017): any progress with the SAML2 integration?
adam commented 2025-12-29 15:32:11 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Oct 20, 2017):

This feature request hasn't gone anywhere since it was opened, and I think part of the problem is that it's not well-defined. Thus, I'm going to close out this issue, and anyone who wants to commit to implementing a specific new form of authentication can raise a new FR detailing their proposal. However, please do so only if you are willing to contribute the necessary effort; unfortunately this is not something to which I can commit development time myself.

@jeremystretch commented on GitHub (Oct 20, 2017): This feature request hasn't gone anywhere since it was opened, and I think part of the problem is that it's not well-defined. Thus, I'm going to close out this issue, and anyone who wants to commit to implementing a specific new form of authentication can raise a new FR detailing their proposal. However, please do so only if **you** are willing to contribute the necessary effort; unfortunately this is not something to which I can commit development time myself.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#82
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?