Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feat add possibility to use Bearer token #1023

Merged
merged 21 commits into from Jun 27, 2023

Conversation

F-PMOR
Copy link
Contributor

@F-PMOR F-PMOR commented Jun 12, 2023

Important information

this is my first contribution for an open source project. I'm not a full dev and have many withdraw with testing process, so I didn't do it with pytest, but I do manual test on my project. So I think some change will have to be done by expert, sorry and thank's for your understanding.

Related Issue

id : 1014

New Behavior

This feature add the possibility to change the type of token that has to be send to netbox or to a proxy behind netbox.
If the type of token is specified as Bearer (or bearer), it's send as a Bearer token

...

Contrast to Current Behavior

A check is done to verify the type of token configured in the ansible inventory file. If Bearer or bearer key is found, then Bearer is added before the key to send in Authorization headers. However, Token is the keyword send as usual.

...

Discussion: Benefits and Drawbacks

Benefit :

  • Bearer token can now be used without effort.
  • Ansible can now connect to Netbox that is protected by a proxy using for exemple Oauth2 authentification.
  • Token key type still can be used without regression.

drawbacks

  • none

Changed has been done cause I use a security proxy behind Netbox that accept only Bearer Token.
For security reason, Token as to be renewed often, this is not managed by this feature change.
It can be done by updating the inventory file.
...

Changes to the Documentation

Some information like below should be added to documentation, but I don't know where ?

In the inventory file :
Token : (string) should contain the token used to connect to netbox. If keyword Bearer is added at the beginning of the token, the plugins will use Bearer token type instead of standard Token type.
exemple :
token: thisismytoken # Token of type : Token
token: Bearer thisismytoken # token of type : Bearer
token: bearer thisismytoken # token of type : Bearer

...

Proposed Release Note Entry

Add Bearer token type.
...

Double Check

  • I have read the comments and followed the CONTRIBUTING.md.
  • I have explained my PR according to the information in the comments or in a linked issue.
  • My PR targets the devel branch.

@sc68cal
Copy link
Contributor

sc68cal commented Jun 12, 2023

So, this Bearer token that you are adding to the header, is this an authentication type that is supported by NetBox, or a proxy specifically?

If this is something specific to your installation of netbox, and a proxy that you have set up to access your specific netbox that requires a bearer token, I don't know that we will want to accept this patch since it is specific to your environment

Copy link
Contributor

@sc68cal sc68cal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Appears to be a change that is to support a single use case of a specific install

@F-PMOR
Copy link
Contributor Author

F-PMOR commented Jun 13, 2023

Appears to be a change that is to support a single use case of a specific install

Hello @sc68cal ,
Netbox support many authentification solution as describe here : https://demo.netbox.dev/static/docs/administration/authentication/
and here : https://python-social-auth.readthedocs.io/en/latest/
One of them is Oauth2, and for Oauth2 works, we need to send a JWT (Json Web Token) to netbox via Authorization Bearer.
So it's not our solution but we use a solution supported by Django to make our Authentification more secure.
Regards,
PM

@rodvand
Copy link
Contributor

rodvand commented Jun 15, 2023

I think this is a valid PR. @F-PMOR Could you just run black to make the formatting ok? Just run ./hacking/black.sh while having the virtual environment enabled.

@sc68cal sc68cal dismissed their stale review June 16, 2023 01:20

dismissing my review

@F-PMOR
Copy link
Contributor Author

F-PMOR commented Jun 16, 2023

I think this is a valid PR. @F-PMOR Could you just run black to make the formatting ok? Just run ./hacking/black.sh while having the virtual environment enabled.

Ok, Thanks @rodvand , I will do it today, I'll send you the result or my miss knowledge of the process... Thank you @sc68cal, for the exchange that permit me to update the comments to argue the RF, Regards

@F-PMOR
Copy link
Contributor Author

F-PMOR commented Jun 20, 2023

Hello @rodvand, check pass successfully, does I have something else do to ?
Thanks,
Philippe

@sc68cal
Copy link
Contributor

sc68cal commented Jun 20, 2023

This needs documentation added so that people understand how to utilize

@F-PMOR
Copy link
Contributor Author

F-PMOR commented Jun 20, 2023

This needs documentation added so that people understand how to utilize

Thanks @sc68cal , where can I put documentation ? It's my first PR and I'm a little bit lost. I put some information to add to the documentation in my PR. Is it enought ?
Regards,
Philippe

@sc68cal
Copy link
Contributor

sc68cal commented Jun 21, 2023

No, you need to at the very least add it to the documentation for the token parameter at the top of the file you have changed, line 83 specifically.

plugins/inventory/nb_inventory.py Outdated Show resolved Hide resolved
plugins/inventory/nb_inventory.py Outdated Show resolved Hide resolved
@sc68cal
Copy link
Contributor

sc68cal commented Jun 22, 2023

Honestly I think this needs some work. I think I would rather see token changed to be a structure with a type and value attribute, with the type's default being token for backwards compatibility

Basically I don't like the string manipulation that you are doing, and would prefer it to be something like:

self.headers.update({"Authorization": f"{{token.type}} {{token.value}}"})

So that we could support the following in configuration:

token:
  type: Bearer
  value: thisismytoken

and

token:
   type: Token
   value: thisismytoken

@F-PMOR
Copy link
Contributor Author

F-PMOR commented Jun 22, 2023

Honestly I think this needs some work. I think I would rather see token changed to be a structure with a type and value attribute, with the type's default being token for backwards compatibility

Basically I don't like the string manipulation that you are doing, and would prefer it to be something like:

self.headers.update({"Authorization": f"{{token.type}} {{token.value}}"})

So that we could support the following in configuration:

token:
  type: Bearer
  value: thisismytoken

and

token:
   type: Token
   value: thisismytoken

Yes, I agree, it's better, but I'm not able to do that ! I ever don't know what's happen and how works the CI linter for Documentation that doesn't pass.
Can you change the code on your side to have something better and taht's work ? I really need help !
Thanks.

@sc68cal
Copy link
Contributor

sc68cal commented Jun 22, 2023

Yep that's fair, I will see if I can add commits to your PR, and then do some research to try and accomplish what I was thinking

This is a bit of a hack, where we set they type to
"Token" and provide a token, so we exercise the new codepath
of having token be a dictionary, but without attempting to test
a new authentication type like Bearer, which we do not have in CI
sc68cal and others added 5 commits June 26, 2023 21:30
This is to try and loosen the constraint, and see if we
can accept both a dictionary and a string.
Add support for a new token type for nb_inventory
@sc68cal sc68cal dismissed their stale review June 27, 2023 14:02

Made the changes I was looking for, but need approval from another maintainer now that I've made changes

@sc68cal
Copy link
Contributor

sc68cal commented Jun 27, 2023

@rovand This can probably be squashed into a single commit and just add me as a co-author via a message at the bottom of the commit message:

Co-Authored-By: Sean M. Collins <sean@coreitpro.com>

@rodvand rodvand merged commit e062ce5 into netbox-community:devel Jun 27, 2023
8 checks passed
@F-PMOR
Copy link
Contributor Author

F-PMOR commented Jun 27, 2023

thanks a lot @sc68cal and @rodvand for this Pull Request.
Regards,
Philippe

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants