'auth > group' and 'auth > user' Permissions Not Taking Effect

[coda88]

NetBox version

v2.10.8

Python version

3.6

Steps to Reproduce

1. Create a new user 'user01' with 'Active' and 'Staff status' (no 'Superuser status')
2. Create a new permission with 'Can view' action and the following Chosen object types: 'auth > group', 'auth > user', 'users > permission' and 'users > token'
3. Assign the new permission to 'user01'

Expected Behavior

1. Log in as 'user01'
2. Navigate to <netbox_url>/admin
3. 'user01' should see 'Groups', 'Permissions', 'Tokens' and 'Users' under the 'USERS' section on the left menu.

Observed Behavior

1. 'user01' is not able to see 'Groups' and 'Users' under the 'USERS' section on the left menu.
2. 'user01' is only able to see 'Permissions' and 'Tokens' under the 'USERS' section on the left menu.

[coda88]

After going through the API, it seems that the correct object types for 'Groups' and 'Users' are 'users > Group' and 'users > User' respectively instead. But these object types are not exposed in the Web GUI.

Tested by modifying users/model.py, after which, 'users > Group' and 'users > User' appears in the GUI under 'Available object types':

$ diff netbox/users/models.py netbox/users/models.py.original
256c256
<             Q(app_label='users', model__in=['admingroup', 'adminuser', 'objectpermission', 'token'])
---
>             Q(app_label='users', model__in=['objectpermission', 'token'])

[jeremystretch]

The discrepancy is due to the use of the abstract AdminUser and AdminGroup classes within the admin UI. IIRC these are employed primarily so that the user and group items appear under the "Users" section of the admin UI. There are probably a couple ways to go about tweaking this; I'll need to dig into it some more.

[jeremystretch]

We can fix this by simply getting rid of the abstract AdminUser and AdminGroup classes, although these models will end up back under "Authorization and Authentication" (rather than "Users") in Django the admin UI, which is a bit confusing. Would love to come up with an elegant solution but haven't had any luck thus far.

[jeremystretch]

IMO we should go ahead with ditching the abstract models to fix the bug in the immediate term. Long term, we'll likely move away from Django's admin UI anyway (in favor of our own custom views).

[jeremystretch]

Long term, we'll likely move away from Django's admin UI anyway (in favor of our own custom views).

Just following up on this: see #6466.