starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-12 05:20:31 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Remote LDAP Authentication broken in the API authentication code path #8247

New Issue
Closed
opened 2025-12-29 20:34:18 +01:00 by adam · 1 comment
adam commented 2025-12-29 20:34:18 +01:00
Owner
Copy Link

Originally created by @rmanyari on GitHub (Jun 26, 2023).

NetBox version

v3.5.4

Python version

3.8

Steps to Reproduce

  1. Set REMOTE_AUTH_BACKEND = "netbox.authentication.LDAPBackend" in configuration.py
  2. Set AUTH_LDAP_FIND_GROUP_PERMS = True in ldap_config.py:
  3. Create a permission that grants access to a resource through an LDAP group membership.
  4. Make a REST API call using a user token a see the request fail with 403.

Expected Behavior

LDAP group memberships are evaluated during the authorization phase when making REST API calls. At the moment permissions are not evaluated consistently across the UI and REST interface.

Observed Behavior

Here's what I found so far, I think it's a fairly quick fix:

  • settings.py sets REMOTE_AUTH_BACKEND to a list, you can see that here.
  • api/authentication.py checks against a string, you can see that here
  • The user object returned by authenticate_credentials is not an LDAP user object, so the permission filter in NBLDAPBackend.get_permission_filter doesn't update the query properly.

My proposed fix is to replace line 63 with:

        if settings.REMOTE_AUTH_BACKEND == ['netbox.authentication.LDAPBackend']:

I made this change on my local instance and I'm getting the expected behavior.

Originally created by @rmanyari on GitHub (Jun 26, 2023). ### NetBox version v3.5.4 ### Python version 3.8 ### Steps to Reproduce 1. Set `REMOTE_AUTH_BACKEND = "netbox.authentication.LDAPBackend"` in `configuration.py` 2. Set `AUTH_LDAP_FIND_GROUP_PERMS = True` in `ldap_config.py`: 3. Create a permission that grants access to a resource through an LDAP group membership. 4. Make a REST API call using a user token a see the request fail with 403. ### Expected Behavior LDAP group memberships are evaluated during the authorization phase when making REST API calls. At the moment permissions are not evaluated consistently across the UI and REST interface. ### Observed Behavior Here's what I found so far, I think it's a fairly quick fix: * `settings.py` sets `REMOTE_AUTH_BACKEND` to a list, you can see that [here](https://github.com/netbox-community/netbox/blob/develop/netbox/netbox/settings.py#L422C5-L422C24). * `api/authentication.py` checks against a string, you can see that [here](https://github.com/netbox-community/netbox/blob/develop/netbox/netbox/api/authentication.py#L63) * The user object returned by `authenticate_credentials` is not an LDAP user object, so the permission filter in [`NBLDAPBackend.get_permission_filter`](https://github.com/netbox-community/netbox/blob/develop/netbox/netbox/authentication.py#L304) doesn't update the query properly. My proposed fix is to replace [line 63](https://github.com/netbox-community/netbox/blob/develop/netbox/netbox/api/authentication.py#L63) with: ``` if settings.REMOTE_AUTH_BACKEND == ['netbox.authentication.LDAPBackend']: ``` I made this change on my local instance and I'm getting the expected behavior.
adam added the type: bugstatus: duplicate labels 2025-12-29 20:34:18 +01:00
adam closed this issue 2025-12-29 20:34:18 +01:00
adam commented 2025-12-29 20:34:19 +01:00
Author
Owner
Copy Link

@DanSheps commented on GitHub (Jun 26, 2023):

Duplicate of #12849

@DanSheps commented on GitHub (Jun 26, 2023): Duplicate of #12849
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: duplicate type: bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#8247
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?