Remote users (LDAP backend) with limited rights lost ability to use RestAPI

[stavr666]

NetBox version

v3.5.3

Python version

3.10

Steps to Reproduce

Perquisite

configuration.py contains:

REMOTE_AUTH_ENABLED = True
REMOTE_AUTH_BACKEND = 'netbox.authentication.LDAPBackend'
REMOTE_AUTH_HEADER = 'HTTP_REMOTE_USER'
REMOTE_AUTH_AUTO_CREATE_USER = True
REMOTE_AUTH_DEFAULT_GROUPS = []
REMOTE_AUTH_DEFAULT_PERMISSIONS = {}

ldap_config.py contains:

AUTH_LDAP_FIND_GROUP_PERMS = True
AUTH_LDAP_MIRROR_GROUPS = False
AUTH_LDAP_FIND_GROUP_PERMS = True

can add full files with masked data paths, if needed.

Our config allow us to have users with rights, assigned by AD group membership. But when checking django group membership, there is none (we ok with it, we have no issues before):

If we tun on mirroring, whole bunch 10th thousands groups from AD will be loaded to netbox.

Issue steps

1. Add one user (Bob) to admin and staff groups, another (Alice) to access group.
2. Create permissions to view anything (or some limited list of objects, we have both scenario) and assign them to Alice.
3. Both Bob and Alice can login to UI and view any objects.
4. Create 2 (read-only in our case) tokens, one for Alice, other for Bob.

Expected Behavior

Tokens must work anywhere and return any data for both users.

Observed Behavior

Both users can use UI, /api/ and /api/schema/swagger-ui/ endpoints while logged in.

Both of them also receive correct answer in Swager, with token used (it's ignored, likely, coz return correct answer with wrong token).

Outside of Netbox app (from Curl, PoSh, Grafana requests) it returns "You do not have permission to perform this action." error.

Problem not existed in 3.0 and 3.1. I used several accounts in Grafana tests before moving Netbox to production, it worked.

Now I must explicitly define group membership of user for API only.

[kkthxbye-code]

See #12858 (reply in thread)

To verify the cause, please try to install django-auth-ldap==4.1.0

[desnoe]

See #12858 (reply in thread)

To verify the cause, please try to install django-auth-ldap==4.1.0

Hello, I tried using django-auth-ldap==4.1.0. Same behaviour as with 4.3.0.

[kkthxbye-code]

@rmanyari - figured out what's wrong in the linked duplicate issue above. When he responds here, he should be assigned this issue.

[rmanyari]

Happy to contribute, feel free to assign this to me