Netbox 2.10.3 permission constraints documentation

[florianschendel]

Hello,

I have some questions regarding the Netbox permissons/constraints.

1. For my understanding I can modify existing Netbox/Django permissions based on some content in DB to manage the access more granularly.

2. I found on the website only the documentation for the version 2.9.x https://netbox.readthedocs.io/en/stable/administration/permissions/
   Is it still valid for 2.10.x? And yes, I know there were some smaller changes in the model but I want to know if the constraints concept should still work in 2.10.x?

3. Based on the 2.9.x documentation I tried to set some additional filter.
   Here is one sample.
   [{"site__name__in": "MU"}]

And I tried already a lot of variants.
I attached the error code below.

My plan is to limit the output for Prefixes/IP-Addresses/VLANs based on the site_name + tenant etc.

Thanks in advance!

Regards
Florian

[candlerb]

I found on the website only the documentation for the version 2.9.x

That is the current documentation for Netbox 2.10. The feature was introduced in 2.9.

Based on the 2.9.x documentation I tried to set some additional filter.

Which object are you setting this on? If this is on "site" then don't include the site__ prefix. However if this is on (say) Device, that's fine because Device has a "site" attribute.

Note that the __in option requires a list on the RHS: it means "the value appears in this list". Hence you'd need to write either:

{"site__name__in": ["MU"]}

or

{"site__name":"MU"}

You'll see this if you look carefully at the examples here: https://netbox.readthedocs.io/en/stable/administration/permissions/#example-constraint-definitions

Looking at your image though, you're trying to set this attribute on the device component "ConsolePort". I suggest you start with some simpler examples first, like setting it on Device.

If you do need to set permissions on ConsolePort, then you'll need to reference attributes which exist on ConsolePort. ConsolePort doesn't have a "site" attribute, but the Device it is attached to does: you'll need something like device__site__...

[florianschendel]

thanks for you quick answer. It works for me if I select only one object in my permission.

e.g. I select only this object in my permission

ipam-->prefix

Constraints

[{"site__name__in": ["YY", "XX"]}, {"tenant__name__in": "ABCD"}]

If I select multiple objects like ipam --> prefix, ipam --> ip address, its not possible to start a correct lookup to the corresponding model.

My question: Is there an option to define the correct model inside the constraints.
e.g.

{"site__name__in": ["YY", "XX"]}, please use ipam> prefix
{"role__name__in": "ABCD"}, please use ipam> ip address
....

Thanks in advance
Regards
Florian

[candlerb]

Create separate permissions for each object type, and grant them to the same group.

[florianschendel]

yes, it´s the only option but it will dramatically increase the amount of permissions if you have many users that need different access rights.

Thanks for your help!

[cpmills1975]

yes, it´s the only option but it will dramatically increase the amount of permissions if you have many users that need different access rights.

Thanks for your help!

Yep. I have about 30 groups - 3 levels of access for 10 different user communities. The rules for each community and access level are similar, but set different constraints against different AD groups. I'm running to over 300 permissions rules. I've had to write a Python script to generate them!