Permission issues with API tokens for non-superusers?

[haxorof]

I recently upgraded Netbox v3.4.5 to v3.4.10 and after that when using the Netbox Ansible inventory plugin I get permission error on several API calls it does. This happens only when I use an API token on a non-superuser. This user however is allowed all actions on all possible models. This worked before without any issues but now I am forced to use a superuser API token to get it to work.

Also tried this in latest v3.5 and same issue there.

Anyone else see this problem?

[abhi1693]

Can you share the API endpoint and how the token and permission are set up for the user? Also, have you tried hitting the endpoint directly using curl or postman?

[haxorof]

I now tested this on demo.netbox.dev but cannot reproduce it there but I will have to look into my installation to see what differs because I is kind of this config I have except for the user and group is originally via LDAP integration. 😢

Here are the steps I tried when trying to reproduce the issue on demo.netbox.dev:

1. Created testapi user
2. Generate API token for testapi user
3. Remove superuser rights
4. Created permission all.rw as seen below:
   
5. Created group testapi
6. Assigned permissions "all.rw" to that group
7. Assigned user testapi.
8. Then in Ansible I use an inventory.yml looking similar to this:

   plugin: netbox.netbox.nb_inventory
   api_endpoint: https://demo.netbox.dev
   validate_certs: True
   config_context: True
   query_filters:
    - name: vm1

9. Run: ansible-inventory -i inventory.yml --graph -vvvv

Looking at the errors printed in ansible-inventory when I do not have configured the permissions then I get same errors as I see in my installation, example below:

$ ansible-inventory -i inventory.yml --graph -vvvv
ansible-inventory [core 2.13.10]
  config file = None
  configured module search path = ['/home/testuser/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/testuser/.venvs/ansible/lib/python3.8/site-packages/ansible
  ansible collection location = /home/testuser/.ansible/collections:/usr/share/ansible/collections
  executable location = /home/testuser/.venvs/ansible/bin/ansible-inventory
  python version = 3.8.10 (default, Mar 15 2022, 12:22:08) [GCC 9.4.0]
  jinja version = 3.1.1
  libyaml = True
No config file found; using defaults
setting up inventory plugins
host_list declined parsing /home/testuser/inventory.yml as it did not pass its verify_file() method
script declined parsing /home/testuser/inventory.yml as it did not pass its verify_file() method
Loading collection netbox.netbox from /home/testuser/.ansible/collections/ansible_collections/netbox/netbox
Using inventory plugin 'ansible_collections.netbox.netbox.plugins.inventory.nb_inventory' to process inventory source '/home/testuser/inventory.yml'
Fetching: https://demo.netbox.dev/api/status
Fetching: https://demo.netbox.dev/api/schema/?format=json
Fetching: https://demo.netbox.dev/api/dcim/devices/?limit=0&name=vm1
Permission denied: https://demo.netbox.dev/api/dcim/devices/?limit=0&name=vm1. This may impair functionality of the inventory plugin.
Fetching: https://demo.netbox.dev/api/virtualization/virtual-machines/?limit=0&name=vm1
Permission denied: https://demo.netbox.dev/api/virtualization/virtual-machines/?limit=0&name=vm1. This may impair functionality of the inventory plugin.
Fetching: https://demo.netbox.dev/api/dcim/sites/?limit=0
Fetching: https://demo.netbox.dev/api/dcim/regions/?limit=0
Fetching: https://demo.netbox.dev/api/dcim/site-groups/?limit=0
Fetching: https://demo.netbox.dev/api/dcim/locations/?limit=0
Fetching: https://demo.netbox.dev/api/tenancy/tenants/?limit=0
Fetching: https://demo.netbox.dev/api/dcim/device-roles/?limit=0
Fetching: https://demo.netbox.dev/api/dcim/manufacturers/?limit=0
Fetching: https://demo.netbox.dev/api/dcim/platforms/?limit=0
Fetching: https://demo.netbox.dev/api/virtualization/clusters/?limit=0
Fetching: https://demo.netbox.dev/api/ipam/services/?limit=0
Fetching: https://demo.netbox.dev/api/dcim/device-types/?limit=0
Fetching: https://demo.netbox.dev/api/dcim/racks/?limit=0
Permission denied: https://demo.netbox.dev/api/tenancy/tenants/?limit=0. This may impair functionality of the inventory plugin.
Permission denied: https://demo.netbox.dev/api/dcim/sites/?limit=0. This may impair functionality of the inventory plugin.
Permission denied: https://demo.netbox.dev/api/dcim/manufacturers/?limit=0. This may impair functionality of the inventory plugin.
Permission denied: https://demo.netbox.dev/api/virtualization/clusters/?limit=0. This may impair functionality of the inventory plugin.
Permission denied: https://demo.netbox.dev/api/dcim/site-groups/?limit=0. This may impair functionality of the inventory plugin.
Permission denied: https://demo.netbox.dev/api/dcim/locations/?limit=0. This may impair functionality of the inventory plugin.
Permission denied: https://demo.netbox.dev/api/dcim/regions/?limit=0. This may impair functionality of the inventory plugin.
Permission denied: https://demo.netbox.dev/api/dcim/platforms/?limit=0. This may impair functionality of the inventory plugin.
Permission denied: https://demo.netbox.dev/api/dcim/device-roles/?limit=0. This may impair functionality of the inventory plugin.
Permission denied: https://demo.netbox.dev/api/dcim/device-types/?limit=0. This may impair functionality of the inventory plugin.
Permission denied: https://demo.netbox.dev/api/dcim/racks/?limit=0. This may impair functionality of the inventory plugin.
Permission denied: https://demo.netbox.dev/api/ipam/services/?limit=0. This may impair functionality of the inventory plugin.
Parsed /home/testuser/inventory.yml inventory source with auto plugin

Can it be that during upgrade some configuration now was not correctly migrated because I have had this configuration since many Netbox versions back and never had this issue before. I will have to dig a bit deeper here in my installation to see if I can see what is going on.

I have not yet run towards the API using curl or postman yet but will do that after some more investigation.

If you have any suggestion where I shall look deeper or try please let me know.

[abhi1693]

I don't know ansible, so I can't say much about your results. I can definitely help if you could show the errors via API using curl or similar tool.

[haxorof]

I noticed that the group that should be populated with users via LDAP config is not happening now and all groups have zero members. To troubleshoot I tried to enable logger "django_auth_ldap" but then the netbox-docker container does not start due to error ValueError: Unable to configure logger 'django_auth_ldap'. Am I missing something here but use the example mentioned on https://docs.netbox.dev/en/stable/installation/6-ldap/#troubleshooting-ldap

[haxorof]

hmm.. maybe my issue is similar to reported issue #12849 since I also use AD and the users belonging to my group there lost its permissions. I cannot mirror all groups.

[kkthxbye-code]

This is the last change to LDAP auth that I am aware of: #10673

It was included in v3.3.6. Not sure what else could cause this. Can you verify that the API works if you disable AUTH_LDAP_FIND_GROUP_PERMS?

[haxorof]

Did not do anything.

Now however I have tested exactly the same configuration which works with Docker image netboxcommunity/netbox:v3.4.5-2.4.0 on version by version until it broke. Here is the result:

v3.4.5-2.4.0 = OK
v3.4.6-2.4.0 = OK
v3.4.6-2.5.1 = OK
v3.4.7-2.5.2 = Not OK

Now I have narrowed it down to that change so I will dig there to see what changes has happened between there.

[kkthxbye-code]

Pretty much has to be this then:

netbox-community/netbox-docker#972

My guess would be this specific change:

django-auth-ldap/django-auth-ldap@fe23ab4

[haxorof]

Looked at that to and it can be the move of the settings that broke something but not all is broken. But login using the LDAP integration works in general and I can see that different users in my system get Staff or Superuser check when the user is first created etc. Confusing. 🙂 It feels now some part of it is not working around assiging permissons where it now seems to require a user to be in the Netbox group to get that. Looking back here in NetBox it has worked without having a user in the Netbox group but it checks the membership via the LDAP still.

[desnoe]

Hello, I'm having the same problem here using netboxcommunity/netbox:v3.5.2.
I tested with AUTH_LDAP_FIND_GROUP_PERMS=false, but then permissions are not applied at all (GUI or API).

[haxorof]

Now when I upgraded from v3.4.6 to v3.6.4 everything seems to be all good again.