SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-06-10 09:22:09 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Identifying a user by their peer_id #1731

New Issue
Closed
opened 2025-11-20 06:05:39 -05:00 by saavagebueno · 16 comments
saavagebueno commented 2025-11-20 06:05:39 -05:00
Owner
Copy Link

Originally created by @tropnikovvl on GitHub (Mar 18, 2025).

Is your feature request related to a problem? Please describe.
At the moment, relay logs are the only way to determine who connected and when.
Logs contain peer_id and IP address, unfortunately there is no easy way to determine what peer_id each user has.

Describe the solution you'd like
Possibility to see in UI detail each user's peer_id.
Possibility to search in UI by peer_id.

Originally created by @tropnikovvl on GitHub (Mar 18, 2025). **Is your feature request related to a problem? Please describe.** At the moment, `relay` logs are the only way to determine who connected and when. Logs contain `peer_id` and IP address, unfortunately there is no easy way to determine what `peer_id` each user has. **Describe the solution you'd like** Possibility to see in UI detail each user's `peer_id`. Possibility to search in UI by `peer_id`.
saavagebueno added the feature-request label 2025-11-20 06:05:39 -05:00
saavagebueno commented 2025-11-20 06:05:40 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Mar 18, 2025):

It is correct, right now client side you can identify a Peer using netbird status -d by:

  • *.netbird.cloud DNS name
  • Netbird's IP address
  • a wireguard public key (which is not visible in the REST API or Dashboard)

You need to put a not-insignificant amount of work into corelating logs to the information identifiable elsewhere

@nazarewk commented on GitHub (Mar 18, 2025): It is correct, right now client side you can identify a Peer using `netbird status -d` by: - `*.netbird.cloud` DNS name - Netbird's IP address - a wireguard public key (which is not visible in the REST API or Dashboard) You need to put a not-insignificant amount of work into corelating logs to the information identifiable elsewhere
saavagebueno commented 2025-11-20 06:05:40 -05:00
Author
Owner
Copy Link

@tropnikovvl commented on GitHub (Mar 18, 2025):

@nazarewk ,
I think it's not very correct to ask each user to provide their peer id so that I can investigate in case of an incident.

I suppose that peers are stored somewhere anyway (maybe in a database or some configs), but this doesn't seem like an easy way to get them.

p.s. I added the word UI to the first message to make expectations as clear as possible

@tropnikovvl commented on GitHub (Mar 18, 2025): @nazarewk , I think it's not very correct to ask each user to provide their peer id so that I can investigate in case of an incident. I suppose that peers are stored somewhere anyway (maybe in a database or some configs), but this doesn't seem like an easy way to get them. p.s. I added the word UI to the first message to make expectations as clear as possible
saavagebueno commented 2025-11-20 06:05:40 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Mar 18, 2025):

I think it's not very correct to ask each user to provide their peer id so that I can investigate in case of an incident.

I feel you, I'm the first (and only) dedicated technical support person for the Netbird. For now (and probably not soon) I don't have any kind of production systems access and I have to debug and work out the issues directly with users with their level of knowledge/access. Apart from business requests (pretty much Netbird Cloud integrations like IdP, trials etc.) I didn't need to ask people with more access to get to the bottom of issues.

Note the user can have a lot of different Peer IDs and you're usually interested in running commands on specific clients/peers only.

@nazarewk commented on GitHub (Mar 18, 2025): > I think it's not very correct to ask each user to provide their peer id so that I can investigate in case of an incident. I feel you, I'm the first (and only) dedicated technical support person for the Netbird. For now (and probably not soon) I don't have any kind of production systems access and I have to debug and work out the issues directly with users with their level of knowledge/access. Apart from business requests (pretty much Netbird Cloud integrations like IdP, trials etc.) I didn't need to ask people with more access to get to the bottom of issues. Note the user can have a lot of different Peer IDs and you're usually interested in running commands on specific clients/peers only.
saavagebueno commented 2025-11-20 06:05:41 -05:00
Author
Owner
Copy Link

@tropnikovvl commented on GitHub (Mar 19, 2025):

@nazarewk
Maybe you know how to determine which peer (they can be seen in UI in the Peers tab) belongs to which user?

The names of the peers have device names and it is difficult to understand whose it is.

p.s. It would be useful to go to a user's profile and see all of their devices (peers).

@tropnikovvl commented on GitHub (Mar 19, 2025): @nazarewk Maybe you know how to determine which peer (they can be seen in UI in the **Peers** tab) belongs to which user? The names of the peers have device names and it is difficult to understand whose it is. p.s. It would be useful to go to a user's profile and see all of their devices (peers).
saavagebueno commented 2025-11-20 06:05:41 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Mar 19, 2025):

the information should already be there for each peer as in the following screenshot:

Image

@nazarewk commented on GitHub (Mar 19, 2025): the information should already be there for each peer as in the following screenshot: ![Image](https://github.com/user-attachments/assets/0467ac54-b461-4624-9e26-eb7bda2af79d)
saavagebueno commented 2025-11-20 06:05:41 -05:00
Author
Owner
Copy Link

@tropnikovvl commented on GitHub (Mar 19, 2025):

@nazarewk
It's weird, but I don't have that.
I set up Dex login and I see emails in the users.

Image

Image

@tropnikovvl commented on GitHub (Mar 19, 2025): @nazarewk It's weird, but I don't have that. I set up Dex login and I see emails in the users. ![Image](https://github.com/user-attachments/assets/705c65e5-09b1-4451-98d0-bccbc0c2a734) ![Image](https://github.com/user-attachments/assets/cb8fcdf3-ff12-4bdd-972d-988b931abe7d)
saavagebueno commented 2025-11-20 06:05:41 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Mar 19, 2025):

You might want to check for the config tweaked at https://github.com/netbirdio/netbird/issues/3524

@nazarewk commented on GitHub (Mar 19, 2025): You might want to check for the config tweaked at https://github.com/netbirdio/netbird/issues/3524
saavagebueno commented 2025-11-20 06:05:41 -05:00
Author
Owner
Copy Link

@tropnikovvl commented on GitHub (Mar 19, 2025):

@nazarewk ,
I use "AuthUserIDClaim": "email", because dex returns this value

https://dexidp.io/docs/openid-connect/

{
  "iss": "https://dex.example.com/",
  "sub": "R29vZCBqb2IhIEdpdmUgdXMgYSBzdGFyIG9uIGdpdGh1Yg",
  "aud": [
    "kubernetes",
    "kubeconfig-generator"
  ],
  "exp": 1712945837,
  "iat": 1712945237,
  "azp": "kubeconfig-generator",
  "at_hash": "OamCo8c60Zdj3dVho3Km5oxA",
  "c_hash": "HT04XtwtlUhfHvm7zf19qsGw",
  "email": "maksim.nabokikh@palark.com",
  "email_verified": true,
  "groups": [
    "administrators",
    "developers"
  ],
  "name": "Maksim Nabokikh",
  "preferred_username": "maksim.nabokikh"
}
@tropnikovvl commented on GitHub (Mar 19, 2025): @nazarewk , I use `"AuthUserIDClaim": "email",` because dex returns this value https://dexidp.io/docs/openid-connect/ ```json { "iss": "https://dex.example.com/", "sub": "R29vZCBqb2IhIEdpdmUgdXMgYSBzdGFyIG9uIGdpdGh1Yg", "aud": [ "kubernetes", "kubeconfig-generator" ], "exp": 1712945837, "iat": 1712945237, "azp": "kubeconfig-generator", "at_hash": "OamCo8c60Zdj3dVho3Km5oxA", "c_hash": "HT04XtwtlUhfHvm7zf19qsGw", "email": "maksim.nabokikh@palark.com", "email_verified": true, "groups": [ "administrators", "developers" ], "name": "Maksim Nabokikh", "preferred_username": "maksim.nabokikh" } ```
saavagebueno commented 2025-11-20 06:05:41 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Mar 19, 2025):

I have found a Dex IdP support feature request to achieve what you are describing.

TLDR; user information synchronization needs to be implemented separately for each IdP.

Please see details and reasoning in https://github.com/netbirdio/netbird/issues/2901#issuecomment-2737893024 and consider whether this issue is resolved and could be closed.

@nazarewk commented on GitHub (Mar 19, 2025): I have found a Dex IdP support feature request to achieve what you are describing. TLDR; user information synchronization needs to be implemented separately for each IdP. Please see details and reasoning in https://github.com/netbirdio/netbird/issues/2901#issuecomment-2737893024 and consider whether this issue is resolved and could be closed.
saavagebueno commented 2025-11-20 06:05:42 -05:00
Author
Owner
Copy Link

@tropnikovvl commented on GitHub (Mar 20, 2025):

@nazarewk
Not sure if that's the issue.

I couldn't tell for sure (without debugging the client app), but either DeviceAuthorizationFlow or PKCEAuthorizationFlow is used when registering a new peer (from client side).
I get this error, which means that the userID was not passed when registering the peer.

failed logging in peer VXHKO1D2dAlo6JmdZXr0fU7lqC2VLrZgftRDhoB/HC8=: no peer auth method provided, please use a setup key or interactive SSO login

https://github.com/netbirdio/netbird/blob/main/management/server/peer.go#L451

Here are the server logs when the new peer was created, and you can clearly see that the userID is empty.

2025-03-20T17:12:47Z INFO management/server/peer.go:811: DEBUG LOGIN INFO {WireGuardPubKey:xxx SSHKey:ssh-edxxx Meta:{Hostname:MacBook-Pro.local GoOS:darwin Kernel:Darwin Core: Platform:arm64 OS:Darwin OSVersion:15.3.1 WtVersion:0.38.2 UIVersion:netbird-desktop-ui/0.38.2 KernelVersion:24.3.0 NetworkAddresses:[{NetIP:fxxx Mac:xxx} {NetIP:xxx Mac:xxx} {NetIP:xxx Mac:xxx} {NetIP:xxx Mac:xxx} {NetIP:xxx Mac:xxx} {NetIP:xxx Mac:xxx}] SystemSerialNumber:xxx SystemProductName:MacBookPro18,3 SystemManufacturer:Apple Inc. Environment:{Cloud: Platform:} Files:[]} UserID: SetupKey: ConnectionIP:xxx ExtraDNSLabels:[]}

And I still can’t understand why this parameter is not picked up when logging in via SSO on client side

@tropnikovvl commented on GitHub (Mar 20, 2025): @nazarewk Not sure if that's the issue. I couldn't tell for sure (without debugging the client app), but either `DeviceAuthorizationFlow` or `PKCEAuthorizationFlow` is used when registering a new peer (from client side). I get this error, which means that the `userID` was not passed when registering the peer. > failed logging in peer VXHKO1D2dAlo6JmdZXr0fU7lqC2VLrZgftRDhoB/HC8=: no peer auth method provided, please use a setup key or interactive SSO login https://github.com/netbirdio/netbird/blob/main/management/server/peer.go#L451 Here are the server logs when the new peer was created, and you can clearly see that the userID is empty. > 2025-03-20T17:12:47Z INFO management/server/peer.go:811: DEBUG LOGIN INFO {WireGuardPubKey:xxx SSHKey:ssh-edxxx Meta:{Hostname:MacBook-Pro.local GoOS:darwin Kernel:Darwin Core: Platform:arm64 OS:Darwin OSVersion:15.3.1 WtVersion:0.38.2 UIVersion:netbird-desktop-ui/0.38.2 KernelVersion:24.3.0 NetworkAddresses:[{NetIP:fxxx Mac:xxx} {NetIP:xxx Mac:xxx} {NetIP:xxx Mac:xxx} {NetIP:xxx Mac:xxx} {NetIP:xxx Mac:xxx} {NetIP:xxx Mac:xxx}] SystemSerialNumber:xxx SystemProductName:MacBookPro18,3 SystemManufacturer:Apple Inc. Environment:{Cloud: Platform:} Files:[]} **UserID**: SetupKey: ConnectionIP:xxx ExtraDNSLabels:[]} And I still can’t understand why this parameter is not picked up when logging in via SSO on client side
saavagebueno commented 2025-11-20 06:05:42 -05:00
Author
Owner
Copy Link

@tropnikovvl commented on GitHub (Mar 20, 2025):

@nazarewk
I noticed that peers in the database have an owner.

sqlite> SELECT * FROM peers;
xxx|"xxx"|MacBook-Pro.local|darwin|Darwin||arm64|Darwin|15.3.1|development||24.3.0|[{"NetIP":"xxx","Mac":"xxx"},{"NetIP":"xxx","Mac":"xxx"},{"NetIP":"xxx","Mac":"xxx"},{"NetIP":"xxx","Mac":"xxx"},{"NetIP":"xxx","Mac":"xxx"},{"NetIP":"xxx","Mac":"xxx"}]|xxx|MacBookPro18,3|Apple Inc.|{"Cloud":"","Platform":""}|[]|MacBook-Pro.local|macbook-pro|2025-03-20 21:44:41.268361396+00:00|0|0|0|vladislav.blabla@blabla.com|xxx|0|1|1|2025-03-20 21:44:41.268361396+00:00|2025-03-20 21:44:41.268361396+00:00|0|"xxx"|xxx|xxx|xxx||0

Question: why is this not displayed on UI?

@tropnikovvl commented on GitHub (Mar 20, 2025): @nazarewk I noticed that peers in the database have an owner. > sqlite> SELECT * FROM peers; > xxx|"xxx"|MacBook-Pro.local|darwin|Darwin||arm64|Darwin|15.3.1|development||24.3.0|[{"NetIP":"xxx","Mac":"xxx"},{"NetIP":"xxx","Mac":"xxx"},{"NetIP":"xxx","Mac":"xxx"},{"NetIP":"xxx","Mac":"xxx"},{"NetIP":"xxx","Mac":"xxx"},{"NetIP":"xxx","Mac":"xxx"}]|xxx|MacBookPro18,3|Apple Inc.|{"Cloud":"","Platform":""}|[]|MacBook-Pro.local|macbook-pro|2025-03-20 21:44:41.268361396+00:00|0|0|0|**vladislav.blabla@blabla.com**|xxx|0|1|1|2025-03-20 21:44:41.268361396+00:00|2025-03-20 21:44:41.268361396+00:00|0|"xxx"|xxx|xxx|xxx||0 Question: why is this not displayed on UI?
saavagebueno commented 2025-11-20 06:05:42 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Mar 21, 2025):

Question: why is this not displayed on UI?

This is probably the user ID field that you have configured with AuthUserIDClaim. The id field is usually a garbled alphanumeric value, so it is not displayed in the UI.

@nazarewk commented on GitHub (Mar 21, 2025): > Question: why is this not displayed on UI? This is probably the user ID field that you have configured with `AuthUserIDClaim`. The `id` field is usually a garbled alphanumeric value, so it is not displayed in the UI.
saavagebueno commented 2025-11-20 06:05:42 -05:00
Author
Owner
Copy Link

@tropnikovvl commented on GitHub (Mar 21, 2025):

@nazarewk ,
I use "AuthUserIDClaim": "email",

@tropnikovvl commented on GitHub (Mar 21, 2025): @nazarewk , I use `"AuthUserIDClaim": "email",`
saavagebueno commented 2025-11-20 06:05:42 -05:00
Author
Owner
Copy Link

@tropnikovvl commented on GitHub (Mar 21, 2025):

@nazarewk
I just checked what information is returned by peers via API.
And I get the correct user ID value with my email.

    {
        "accessible_peers_count": 0,
        "approval_required": false,
        "city_name": "xxx",
        "connected": true,
        "connection_ip": "xxx",
        "country_code": "xxx",
        "dns_label": "macbook-pro.netbird.selfhosted",
        "extra_dns_labels": [],
        "geoname_id": "xxx",
        "groups": [
            {
                "id": "xxx",
                "name": "All",
                "peers_count": 3,
                "resources_count": 0
            }
        ],
        "hostname": "MacBook-Pro.local",
        "id": "xxx",
        "inactivity_expiration_enabled": true,
        "ip": "xxx",
        "kernel_version": "24.3.0",
        "last_login": "2025-03-21T10:12:18.479683429Z",
        "last_seen": "2025-03-21T10:50:02.130525774Z",
        "login_expiration_enabled": true,
        "login_expired": false,
        "name": "MacBook-Pro.local",
        "os": "Darwin 15.3.1",
        "serial_number": "xxx",
        "ssh_enabled": false,
        "ui_version": "netbird-desktop-ui/0.38.2",
        "user_id": "vladislav.xxx@xxx",
        "version": "0.38.2"
    },

Considering the dashboard asks for the same information, it's very strange that it's not displayed.
https://github.com/netbirdio/dashboard/blob/main/src/contexts/PeersProvider.tsx#L16
https://github.com/netbirdio/dashboard/blob/main/src/app/(dashboard)/peers/page.tsx#L44

@tropnikovvl commented on GitHub (Mar 21, 2025): @nazarewk I just checked what information is returned by peers via API. And I get the correct user ID value with my email. ```json { "accessible_peers_count": 0, "approval_required": false, "city_name": "xxx", "connected": true, "connection_ip": "xxx", "country_code": "xxx", "dns_label": "macbook-pro.netbird.selfhosted", "extra_dns_labels": [], "geoname_id": "xxx", "groups": [ { "id": "xxx", "name": "All", "peers_count": 3, "resources_count": 0 } ], "hostname": "MacBook-Pro.local", "id": "xxx", "inactivity_expiration_enabled": true, "ip": "xxx", "kernel_version": "24.3.0", "last_login": "2025-03-21T10:12:18.479683429Z", "last_seen": "2025-03-21T10:50:02.130525774Z", "login_expiration_enabled": true, "login_expired": false, "name": "MacBook-Pro.local", "os": "Darwin 15.3.1", "serial_number": "xxx", "ssh_enabled": false, "ui_version": "netbird-desktop-ui/0.38.2", "user_id": "vladislav.xxx@xxx", "version": "0.38.2" }, ``` Considering the dashboard asks for the same information, it's very strange that it's not displayed. https://github.com/netbirdio/dashboard/blob/main/src/contexts/PeersProvider.tsx#L16 https://github.com/netbirdio/dashboard/blob/main/src/app/(dashboard)/peers/page.tsx#L44
saavagebueno commented 2025-11-20 06:05:42 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Mar 21, 2025):

Maybe I did not put it clearly enough that user_id is not considered a type of a human-readable value and is not displayed anywhere.

@nazarewk commented on GitHub (Mar 21, 2025): Maybe I did not put it clearly enough that `user_id` is not considered a type of a human-readable value and is not displayed anywhere.
saavagebueno commented 2025-11-20 06:05:43 -05:00
Author
Owner
Copy Link

@tropnikovvl commented on GitHub (Mar 27, 2025):

Fixed by https://github.com/netbirdio/dashboard/pull/450

@tropnikovvl commented on GitHub (Mar 27, 2025): Fixed by https://github.com/netbirdio/dashboard/pull/450
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label feature-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#1731
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?