Permission Constrains with custom fields

[PieterL75]

Hey,

I want to create a permission that gives access to all objects that have one specific tenant set.
The unique value of the tenant is set in a custom field. I could use the 'slug' for this purpose, but I thought I read that slugs were going to be deprecated in some way.

What is the correct way to write a filter for that ? I tried some things, but the UI always comes back with the error
Invalid filter for <class 'django.contrib.auth.models.Group'>: Cannot resolve keyword 'tenant' into field. Choices are: id, name, object_permissions, permissions, user
Examples I tried: (with single and double underscores)
[{"tenant__cf_snow_account_number": "12345"}]
[{"tenant_id": "11"}]

Please advise

[candlerb]

The database field is called custom_field_data not cf (cf is just a python property). See #6478. That implies {"tenant__custom_field_data__snow_account_number": "12345"}

However the error suggests you're trying to restrict access to something that doesn't have a "tenant" field anyway. Can you show a more complete extract of your configuration? And what Netbox version are you running?

Aside: I agree for your use case that a stable, immutable reference is required. There is indeed some uncertainty around slugs, and in any case they are mutable. Could you just use the netbox tenant id instead (i.e. the database-assigned integer)? It won't change unless the tenant is deleted and recreated. But it won't align between, say, production and test databases.

[PieterL75]

I did select ALL 'Object types'.. and is apparently causing problems... When I select just one (like ipam|vlan), then I get the error
Invalid filter for <class 'ipam.models.vlans.VLAN'>: Cannot resolve keyword 'vlan' into field. Choices are: created, custom_field_data, description, group, group_id, id, interfaces_as_tagged, interfaces_as_untagged, journal_entries, last_updated, name, prefixes, role, role_id, site, site_id, status, tagged_items, tags, tenant, tenant_id, vid, vminterfaces_as_tagged, vminterfaces_as_untagged
with the constrain
[{"vlan__tenant": 123}]

[PieterL75]

So the constrain will only allow fields that exists on ALL selected objects..
This means that I have to cherrypick only the objects that have a 'tenant' field.

Is there a way to make this more generic, so that the constrain will ignore objects that does not have the field specified ?

[candlerb]

So the constrain will only allow fields that exists on ALL selected objects..
This means that I have to cherrypick only the objects that have a 'tenant' field.

Exactly.

Is there a way to make this more generic, so that the constrain will ignore objects that does not have the field specified ?

I don't think so. Either it would fail to grant any access to objects where the constraint is not meaningful, or worse, it would grant permissions to all objects of that type without you realising it.

What you can do is to create multiple permission objects with different (meaningful) constraints, and then apply them all to the same group. In this case I think you just need two permissions:

• one for objects which have tenant, and you want to restrict to a specific tenant
• one for objects where you want to allow unrestricted access (e.g. site)

This second permission could be shared between tenants.

[PieterL75]

Brian,

Thank you for thinking with me.. It's clear to me now.
I will indeed need play with separate permission objects to accomplish my goal.

ty !

Pieter

[taher1333]

i need to the user view all elements on specify site group