Permission denied: This may impair functionality of the inventory plugin.

[simo735]

Hello,

I can't use Netbox API to extract devices with ansible-inventory. i get the error message 'Permission denied' even tough i give the token all the necessary permissions.

Version
Netbox V2.11.9
Python 3.6

The the content of netbox_inventory.yml :

plugin: netbox.netbox.nb_inventory
api_endpoint: https://netbox_server/
validate_certs: False
Token: xxxxxxxx

Error Message with the cmd: ansible-inventory -v --list -i netbox_inventory.yml

Permission denied: https://netbox_server/api/dcim/devices/?limit=0&exclude=config_context. This may impair functionality of the inventory plugin.
Fetching: https://netbox_server/api/virtualization/virtual-machines/?limit=0&exclude=config_context
Permission denied: https://netbox_server/api/virtualization/virtual-machines/?limit=0&exclude=config_context. This may impair functionality of the inventory plugin.
Fetching: https://netbox_server/api/dcim/sites/?limit=0
Fetching: https://netbox_server/api/dcim/regions/?limit=0
Fetching: https://netbox_server/api/dcim/locations/?limit=0
Fetching: https://netbox_server/api/tenancy/tenants/?limit=0
Fetching: https://netbox_server/api/dcim/racks/?limit=0
Fetching: https://netbox_server/api/dcim/device-roles/?limit=0
Fetching: https://netbox_server/api/dcim/platforms/?limit=0
Fetching: https://netbox_server/api/dcim/device-types/?limit=0
Permission denied: https://netbox_server/api/dcim/sites/?limit=0. This may impair functionality of the inventory plugin.
Fetching: https://netbox_server/api/dcim/manufacturers/?limit=0
Fetching: https://netbox_server/api/virtualization/clusters/?limit=0
Fetching: https://netbox_server/api/ipam/services/?limit=0
Permission denied: https://netbox_server/api/dcim/regions/?limit=0. This may impair functionality of the inventory plugin.
Permission denied: https://netbox_server/api/dcim/locations/?limit=0. This may impair functionality of the inventory plugin.
Permission denied: https://netbox_server/api/tenancy/tenants/?limit=0. This may impair functionality of the inventory plugin.
Permission denied: https://netbox_server/api/dcim/racks/?limit=0. This may impair functionality of the inventory plugin.
Permission denied: https://netbox_server/api/dcim/manufacturers/?limit=0. This may impair functionality of the inventory plugin.
Permission denied: https://netbox_server/api/dcim/platforms/?limit=0. This may impair functionality of the inventory plugin.
Permission denied: https://netbox_server/api/virtualization/clusters/?limit=0. This may impair functionality of the inventory plugin.
Permission denied: https://netbox_server/api/dcim/device-types/?limit=0. This may impair functionality of the inventory plugin.
Permission denied: https://netbox_server/api/dcim/device-roles/?limit=0. This may impair functionality of the inventory plugin.
Permission denied: https://netbox_server/api/ipam/services/?limit=0. This may impair functionality of the inventory plugin.

Can you help me please ?
Thank you in advance

[candlerb]

It will be easier to debug this if you make an API request by hand using curl, and then you can see the error message returned.

curl -H 'Authorization: Token XXXXXXXX' 'https://netbox_server/api/dcim/sites/?limit=0'

The token is attached to a user, and the user needs to have read permissions on those models. You can try setting the user to "Superuser" temporarily to prove whether this is the problem. Then you can grant them a lesser, specific set of permissions.

As another option, you can permit global read-only access to Netbox data (including anonymous users), with:

EXEMPT_VIEW_PERMISSIONS = ['*']

Or it could be that you have Netbox sitting behind a proxy which enforces its own authentication. In that case, you'll either need to configure the inventory plugin to provide that extra authentication, or exempt the source IP address from authentication in the proxy.

[simo735]

Hello Candlerb,

First of all I would like to thank you for your reply.
My netbox server isn't behind a proxy so there is no need for extra authentication in my case.
Otherwise, I grant to my user the 'Superuser' right, even tough I have the same error message.
When I use curl, all the commands worked well. For example to get device-types:

Using ansible-inventory: (KO)
Permission denied: https://netbox_server/api/dcim/device-types/?limit=0. This may impair functionality of the inventory plugin.

Using curl: (OK)
curl -H 'Authorization: Token xxxxxx' 'https://netbox_server/api/dcim/device-types/?limit=0'

{
"count": 1,
"next": null,
"previous": null,
"results": [
{
......
}
]
}

I can't undrestand why the token is accepted when i use curl and not when using ansible-inventory.

[candlerb]

Perhaps it's because you've put Token: xxxxxxxx in the yaml file, whereas it should be token: xxxxxxxxx

[simo735]

@candlerb well seen, thank you very much.