Repository: netbox-community/netbox

Issue:
Dynamically pass credentials to the Napalm module
<!--
    Before opening a new issue, please search through the existing issues to
    see if your topic has already been addressed. Note that you may need to
    remove the "is:open" filter from the search bar to include closed issues.

    Check the appropriate type for your issue below by placing an x between the
    brackets. For assistance with installation issues, or for any other issues
    other than those listed below, please raise your topic for discussion on
    our mailing list:

        https://groups.google.com/forum/#!forum/netbox-discuss

    Please note that issues which do not fall under any of the below categories
    will be closed. Due to an excessive backlog of feature requests, we are
    not currently accepting any proposals which extend NetBox's feature scope.

    Do not prepend any sort of tag to your issue's title. An administrator will
    review your issue and assign labels as appropriate.
--->
### Issue type
[x] Feature request <!-- An enhancement of existing functionality -->
[ ] Bug report      <!-- Unexpected or erroneous behavior -->
[ ] Documentation   <!-- A modification to the documentation -->

<!--
    Please describe the environment in which you are running NetBox. (Be sure
    to verify that you are running the latest stable release of NetBox before
    submitting a bug report.) If you are submitting a bug report and have made
    any changes to the code base, please first validate that your bug can be
    recreated while running an official release.
-->
### Environment
* Python version: 3.5.4 <!-- Example: 3.5.4 -->
* NetBox version:  2.1.3 <!-- Example: 2.1.3 -->

<!--
    BUG REPORTS must include:
        * A list of the steps needed for someone else to reproduce the bug
        * A description of the expected and observed behavior
        * Any relevant error messages (screenshots may also help)

    FEATURE REQUESTS must include:
        * A detailed description of the proposed functionality
        * A use case for the new feature
        * A rough description of any necessary changes to the database schema
        * Any relevant third-party libraries which would be needed
-->
### Description
Please implement a way to pass SSH credentials to the Napalm module via the web interface or login creds.

I require a dynamic way to pass the --user and --password Naplam values to the module. My goal is to hookup NetBox to LDAP therefore allowing users to auth with NetBox and query devices using Napalm with the same creds.

Thanks,


Discussion:
> I require a dynamic way to pass the --user and --password Naplam values to the module.

What is the modification being proposed?
Could the device details be edited to provide an option to specify a "secret" that is defined in NetBox that can then be passed to NAPALM?

I don't believe applying such a setting anywhere other than per-device makes much other sense, unless a "Device Group" feature is implemented in the future.  

This would be very scaleable as if the login is used across a range of devices (such as per-customer), editing it in one place (say when the RADIUS/TACACS password is updated) and then all devices that it applies to, NAPALM will use the correct details.

Thanks for putting together such a great tool...keep these improvements coming.
> Could the device details be edited to provide an option to specify a "secret" that is defined in NetBox that can then be passed to NAPALM?

You would still need to pass an active session key to NetBox to unlock the secret so that its plaintext value can be fed to NAPALM. I don't think that will work for a GET API request, since we need to keep any sensitive data out of the query string. So, we would need to extend the NAPALM API endpoint to accept POST requests as well.

This might be okay for the API request, but I'm not a fan of extending the device model to point to a secret to use for NAPALM. That feels very hacky, and would be difficult to manage at scale.
An alternative to using POST requests would be to pass the username and password as HTTP headers. For example:

```
curl \
-H "Authorization: Token <TOKEN>" \
-H "NAPALM-Username: <USERNAME>" \
-H "NAPALM-Password: <PASSWORD>" \
-H "Content-Type: application/json" \
-H "Accept: application/json; indent=4" \
https://netbox/api/dcim/devices/<PK>/napalm/?method=get_facts
```

The provided parameters would override the statically configured credentials. This approach could be extended to support other arguments as well.
we are currently running into exactly the same problem described above and asking for a possible solution period or a way to "bypass" the issue at the moment ?

We use different static usernames and passwords for different devices.

How about getting the usernames and passwords from the "Contextual Configuration Data" ?


Resolving patch:
diff --git a/netbox/dcim/api/views.py b/netbox/dcim/api/views.py
--- a/netbox/dcim/api/views.py
+++ b/netbox/dcim/api/views.py
@@ -396,13 +396,29 @@ def napalm(self, request, pk):
         napalm_methods = request.GET.getlist('method')
         response = OrderedDict([(m, None) for m in napalm_methods])
         ip_address = str(device.primary_ip.address.ip)
+        username = settings.NAPALM_USERNAME
+        password = settings.NAPALM_PASSWORD
         optional_args = settings.NAPALM_ARGS.copy()
         if device.platform.napalm_args is not None:
             optional_args.update(device.platform.napalm_args)
+
+        # Update NAPALM parameters according to the request headers
+        for header in request.headers:
+            if header[:9].lower() != 'x-napalm-':
+                continue
+
+            key = header[9:]
+            if key.lower() == 'username':
+                username = request.headers[header]
+            elif key.lower() == 'password':
+                password = request.headers[header]
+            elif key:
+                optional_args[key.lower()] = request.headers[header]
+
         d = driver(
             hostname=ip_address,
-            username=settings.NAPALM_USERNAME,
-            password=settings.NAPALM_PASSWORD,
+            username=username,
+            password=password,
             timeout=settings.NAPALM_TIMEOUT,
             optional_args=optional_args
         )


Test patch: