Provider Auth

[apishark]

What is a good approach to associate user API tokens to Providers. I want to know which provider is making an API call and I can only get the User from my plugin?

[candlerb]

What do you mean by "Provider" in this context?

All Netbox authentication is done as Users. All tokens are associated to Users. You could identify what Groups the User belongs to, but I can't think of any "Provider" that relates to Users.

[apishark]

https://netbox.readthedocs.io/en/stable/models/circuits/provider/

I want to let authenticated Providers into my netbox in order to manage my circuits. I also need to filter API calls so providers cannot manage other providers, only there own circuits.

I am now going down the path of creating a View to allow Admin to assign Users to Providers and then using Querysets to filter the API responses.

I am merely questioning if my approach is correct, or if there is a smarter way of achieving this?

[candlerb]

I want to let authenticated Providers into my netbox

But how do you "authenticate a provider", if they are not also a user?

It seems to me what you want is:

1. Create a User for each provider
2. Put all the provider users into a group, and grant permissions to that group (assuming all providers see the same; if not, make separate permissions for each provider)
3. Create a token for each provider user (or they can do this themselves, if they know their own user password)

[apishark]

I have followed steps 1,2 and 3 from the docs and configured in the UI but, this leaves me with no correlation between Provider ID and User ID, so I can't apply a Querysets to filter the API responses, e.g:

queryset = Circuit.objects.filter(provider_id=1)

The providers are using machine accounts, e.g. [email protected].

[candlerb]

There are no existing associations between User and Provider. You could however add a custom field on Provider to give the related username, and search on that.

[apishark]

I was heading down that route. As you also pointed me in that direction, I now have more confidence that I might be doing the right thing and not missing something fundamental. Thankyou for your advice.