How to know which permission constraints to use?

[CaptainBalou]

Hello all,

I really like Netbox after testing it since a few weeks. Awesome tool with a lot of features and the possibility to have plugins to enhance functionality. So first of all a big 'Thank You' to all the developers that I can test and use this software for free.

I'm just struggling with one thing since days and this is to create the permission constraints for the users and groups.
It may seem obvious for the developers and very experienced users how to build the constraints but for me it feels impossible to get everything set up. Even after reading documentation, discussions and issues…

So my question here today is:"Is there a way how I can get constraints built without having developer skills or without being an experienced 'using Netbox since years'-user?"

My company structure looks similar to this:

My goal is to have permission groups for all departments to let them view or edit the things they're supposed to work on. I already found ways to get much things working.

But those haven't been created by myself's smartness - they're just copied out of discussions, issues and so on. :-) I would have never found things like "[{"terminations___device__tenant__group": 6}]" and so on.

I have some things I'm not able to find out myself. So this I why I'm seeking for help. Is there a way to find out which constraints are possible at all and then how they've to be built? A kind of generic path through which one always finds the destination?

Kind regards
Marco

[jsenecal]

Hi @CaptainBalou ,

So the constraints docs are over here: https://docs.netbox.dev/en/stable/administration/permissions/#constraints I dont know if you've seen those.

Constraints are expressed as a JSON object or list representing a Django query filter. Those are built from the objects fields and their relationships with other objects. As with query filters, double underscores can be used to traverse related objects or invoke lookup expressions.
Generally, looking up the api docs can help with figuring out the field names. You can also browse the models source code for even more info, but that's a bit more advanced/involved.

[CaptainBalou]

Hello @jsenecal,

Thank you very much for your reply. I really appreciate that.

Yes, I saw that documentation and also the API docs page. But, as someone with no development skill except writing some bash scripts all of this sounds like rocket science. :-) I had nothing to do with Jinja2, Django and such things. Django still sounds like a dance style to me somehow. ;-)

I was reading and testing for hours now but I don't get it done. Also ChatGPT has no valid answer for me except that it tells me that it absolutely understands your answer. :-)

If I may get some more of your time I would like to try it with an example. Perhaps I'm trying to do something which is not even possible?! So let me explain one thing I want to achieve:

• User A is in group GroupZ and is allowed to work on all devices of tenant group 6. Means if the user clicks on 'devices' he can see all devices out of that tenant. This is working pretty well.
• So now I have the virtual chassis and because I can't map this to a tenant group I'd like to allow the user just to see virtual chassis which contains devices out of his tenant group 6.

This is may be a very specific corner case but first it's one thing I have on my list and second I hope, because this sounds so easy, is an example to finally understand it.
Ideally don't say "take abc__def_xyz - this is the correct answer", but tell me how I get there.

I know this takes your valuable time, but I hope I and others without developer skills can better understand how permissions work through this. I don't think I'll get an extraordinary Django dancer at the end but hopefully I'd be able to get this wonderful piece of software into my company.

Thanks again for you answer and willingness zu help out here.

All the best
Marco

[jsenecal]

So, you may have hit a limitation of what can be done with a query filter. The __in keyword would need to be used against another queryset of related objects or a list of IDs (static per permission, not scalable, etc), The other queryset thing I mentioned is not possible with the current implementation afaik.

Maybe @jeremystretch can chime in (he designed the permissions system) ?

[CaptainBalou]

If this is a some kind limitation of the permission system then this is bad to learn how it works. Perhaps someone can explain the system with another example. I know this is currently set up in my Netbox system and works somehow. :-)

dcim | cable
[{"terminations___device__tenant__group": 6}]

I don't see a field terminations nor anything with tenant and group of devices. So how is that "path" built and were can I see which possibilities are there at all? At least for me this is not described in the documentation. At least not in a form I could get as a non-developer.

I'd be happy to get as much information as possible to, hopefully, finally understand the permission system. If @jeremystretch is around that would be absolutely perfect for sure. Or possibly another non-developer like me had issues understanding it in the beginning but finally understood it by a very simple way. :-) Any help is very much appreciated.

[kkthxbye-code]

The Cable model has a terminations field that is a reverse relation to the CableTermination models termination field. In the case of a simple 1 to 1 cable, the Cable.terminations will contain two CableTermination objects, one for each end of the cable. The CableTermination model has a _device field and in turn the Device model has a tenant field and in turn the Tenant model has a group field.

There is currently no resources that give an understanding of this system to non-technical users. The system is pretty complex and as such requires some amount of knowledge about django QuerySet filtering and model definitions.

So now I have the virtual chassis and because I can't map this to a tenant group I'd like to allow the user just to see virtual chassis which contains devices out of his tenant group 6.

[{"members__tenant__group": 6}]

Something like the above should work. It will only show virtual chassis where at least on member has a tenant group id of 6.

An easier solution would probably be to just add a custom field tenantgroup to the virtual chassis type with a custom field type of object and a target object type of tenant group. Then you can use a filter like this:

[{"custom_field_data__tenantgroup": 6}]

[CaptainBalou]

First of all thanks for your answer @kkthxbye-code, also thanks @jsenecal.

Also after reading the documentation it was still unclear to me how one comes to the conclusion that e.g. with dcim | cable [{"terminations___device__tenant__group": 6}] the related field is called terminations.

So because I've no idea of programming I decided to call a friend of mine. It's ChatGPT. We had a very long conversation. I reached the maximum question limit per hour several times on some days. :-)

In the end I figured out a script that helped me to get answers that were hidden to me before. The script is not very extensive and the output also looks very unusual. I share the script anyway to give other people the chance to benefit from it. Feel free to express your opinion - I can handle ridicule. ;-)

from django.apps import apps
from extras.scripts import Script, StringVar, ChoiceVar


class FindRelatedFieldsScript(Script):
    class Meta:
        name = "Find Related Fields"
        description = "Find all possible related fields for a NetBox model"
        field_order = ["app_name", "model_name"]

    app_name = ChoiceVar(
        label="App Name",
        choices=sorted([(app.label, app.verbose_name) for app in apps.get_app_configs()]),
    )

    model_name = StringVar(
        label="Model Name", description="Name of the NetBox model to find related fields for"
    )

    def run(self, data, commit):
        app_label = data["app_name"]
        model_name = data["model_name"]
        model = apps.get_model(app_label, model_name)

        self.log_success(f"Model {model_name} in app {app_label} has the following related fields:")
        for field in model._meta.get_fields(include_hidden=True):
            if field.is_relation:
                self.log_success(f"- {field.name} (model: {field.related_model.__name__})")

Getting all possible model names as a dropdown menu after selecting the app name did not work for me. Likewise getting everything displayed in lower case. Anyway.

Now I can choose an app name like dcim and specify a model like cable.

Afterwards all related fields are displayed with which I can build constraints. Some output looks weird and is possibly wrong, but until know I found some helpful fields I could use.

In the following I go step by step through the script by searching and taking the value, add __ and repeat that until I reached my goal. For sure it would be much better to give parameters for where I am, where I want to go to and then the complete constraint would be automaticall build on the screen - but I can't do that. ChatGPT was also unable to generate code for that which hasn't hit an error.
Hereby I could successfully solve the case with the virtual_chassis. @kkthxbye-code was obviously correct ;-)

[{"members__tenant__group": 6}]

Since I also have colleagues who will create virtual_chassis without members I extended the constraint like this.

[{"members__tenant__group": 6}, {"members__virtual_chassis__isnull": true}]

I also found that path of members__virtual_chassis__isnull via the described way. For me as a non-developer the only way to reach my goal. ;-)

Without your help (and ChatGPT) I would never have been able to do this. Thanks again.

All the best
Marco

[jonatangobbato]

@CaptainBalou i created the script, but when i run, i get an eternal 'Pending' status, can you help me?

[eric-j-ason]

The typical use case, I would have thought, would be to say that "yours is this site and everything that's in it". Is there no easy way to do that? Is that not the intended use?

[st-nip]

That's what I want too. Everything under a certain site, do what you want. Anything tagged with a different site or untagged, read-only.

[pchiquit]

Just leaving this for a reference for future users. An uncomplicated way to find out what are the possible constraints is to use the graphQL navigator: https://demo.netbox.dev/graphql/
The navigator has all the elements that you can use in the constraints, and you can navigate to see which objects share the same attributes.