Identifying a user by their peer_id

[tropnikovvl]

Is your feature request related to a problem? Please describe.
At the moment, relay logs are the only way to determine who connected and when.
Logs contain peer_id and IP address, unfortunately there is no easy way to determine what peer_id each user has.

Describe the solution you'd like
Possibility to see in UI detail each user's peer_id.
Possibility to search in UI by peer_id.

[nazarewk]

It is correct, right now client side you can identify a Peer using netbird status -d by:

• *.netbird.cloud DNS name
• Netbird's IP address
• a wireguard public key (which is not visible in the REST API or Dashboard)

You need to put a not-insignificant amount of work into corelating logs to the information identifiable elsewhere

[tropnikovvl]

@nazarewk ,
I think it's not very correct to ask each user to provide their peer id so that I can investigate in case of an incident.

I suppose that peers are stored somewhere anyway (maybe in a database or some configs), but this doesn't seem like an easy way to get them.

p.s. I added the word UI to the first message to make expectations as clear as possible

[nazarewk]

I think it's not very correct to ask each user to provide their peer id so that I can investigate in case of an incident.

I feel you, I'm the first (and only) dedicated technical support person for the Netbird. For now (and probably not soon) I don't have any kind of production systems access and I have to debug and work out the issues directly with users with their level of knowledge/access. Apart from business requests (pretty much Netbird Cloud integrations like IdP, trials etc.) I didn't need to ask people with more access to get to the bottom of issues.

Note the user can have a lot of different Peer IDs and you're usually interested in running commands on specific clients/peers only.

[tropnikovvl]

@nazarewk
Maybe you know how to determine which peer (they can be seen in UI in the Peers tab) belongs to which user?

The names of the peers have device names and it is difficult to understand whose it is.

p.s. It would be useful to go to a user's profile and see all of their devices (peers).

[nazarewk]

the information should already be there for each peer as in the following screenshot:

[tropnikovvl]

@nazarewk
It's weird, but I don't have that.
I set up Dex login and I see emails in the users.

[nazarewk]

You might want to check for the config tweaked at #3524

[tropnikovvl]

@nazarewk ,
I use "AuthUserIDClaim": "email", because dex returns this value

https://dexidp.io/docs/openid-connect/

{
  "iss": "https://dex.example.com/",
  "sub": "R29vZCBqb2IhIEdpdmUgdXMgYSBzdGFyIG9uIGdpdGh1Yg",
  "aud": [
    "kubernetes",
    "kubeconfig-generator"
  ],
  "exp": 1712945837,
  "iat": 1712945237,
  "azp": "kubeconfig-generator",
  "at_hash": "OamCo8c60Zdj3dVho3Km5oxA",
  "c_hash": "HT04XtwtlUhfHvm7zf19qsGw",
  "email": "maksim.nabokikh@palark.com",
  "email_verified": true,
  "groups": [
    "administrators",
    "developers"
  ],
  "name": "Maksim Nabokikh",
  "preferred_username": "maksim.nabokikh"
}

[nazarewk]

I have found a Dex IdP support feature request to achieve what you are describing.

TLDR; user information synchronization needs to be implemented separately for each IdP.

Please see details and reasoning in #2901 (comment) and consider whether this issue is resolved and could be closed.

[tropnikovvl]

@nazarewk
Not sure if that's the issue.

I couldn't tell for sure (without debugging the client app), but either DeviceAuthorizationFlow or PKCEAuthorizationFlow is used when registering a new peer (from client side).
I get this error, which means that the userID was not passed when registering the peer.

failed logging in peer VXHKO1D2dAlo6JmdZXr0fU7lqC2VLrZgftRDhoB/HC8=: no peer auth method provided, please use a setup key or interactive SSO login

https://github.com/netbirdio/netbird/blob/main/management/server/peer.go#L451

Here are the server logs when the new peer was created, and you can clearly see that the userID is empty.

2025-03-20T17:12:47Z INFO management/server/peer.go:811: DEBUG LOGIN INFO {WireGuardPubKey:xxx SSHKey:ssh-edxxx Meta:{Hostname:MacBook-Pro.local GoOS:darwin Kernel:Darwin Core: Platform:arm64 OS:Darwin OSVersion:15.3.1 WtVersion:0.38.2 UIVersion:netbird-desktop-ui/0.38.2 KernelVersion:24.3.0 NetworkAddresses:[{NetIP:fxxx Mac:xxx} {NetIP:xxx Mac:xxx} {NetIP:xxx Mac:xxx} {NetIP:xxx Mac:xxx} {NetIP:xxx Mac:xxx} {NetIP:xxx Mac:xxx}] SystemSerialNumber:xxx SystemProductName:MacBookPro18,3 SystemManufacturer:Apple Inc. Environment:{Cloud: Platform:} Files:[]} UserID: SetupKey: ConnectionIP:xxx ExtraDNSLabels:[]}

And I still can’t understand why this parameter is not picked up when logging in via SSO on client side

[tropnikovvl]

@nazarewk
I noticed that peers in the database have an owner.

sqlite> SELECT * FROM peers;
xxx|"xxx"|MacBook-Pro.local|darwin|Darwin||arm64|Darwin|15.3.1|development||24.3.0|[{"NetIP":"xxx","Mac":"xxx"},{"NetIP":"xxx","Mac":"xxx"},{"NetIP":"xxx","Mac":"xxx"},{"NetIP":"xxx","Mac":"xxx"},{"NetIP":"xxx","Mac":"xxx"},{"NetIP":"xxx","Mac":"xxx"}]|xxx|MacBookPro18,3|Apple Inc.|{"Cloud":"","Platform":""}|[]|MacBook-Pro.local|macbook-pro|2025-03-20 21:44:41.268361396+00:00|0|0|0|vladislav.blabla@blabla.com|xxx|0|1|1|2025-03-20 21:44:41.268361396+00:00|2025-03-20 21:44:41.268361396+00:00|0|"xxx"|xxx|xxx|xxx||0

Question: why is this not displayed on UI?

[nazarewk]

Question: why is this not displayed on UI?

This is probably the user ID field that you have configured with AuthUserIDClaim. The id field is usually a garbled alphanumeric value, so it is not displayed in the UI.

[tropnikovvl]

@nazarewk ,
I use "AuthUserIDClaim": "email",

[tropnikovvl]

@nazarewk
I just checked what information is returned by peers via API.
And I get the correct user ID value with my email.

    {
        "accessible_peers_count": 0,
        "approval_required": false,
        "city_name": "xxx",
        "connected": true,
        "connection_ip": "xxx",
        "country_code": "xxx",
        "dns_label": "macbook-pro.netbird.selfhosted",
        "extra_dns_labels": [],
        "geoname_id": "xxx",
        "groups": [
            {
                "id": "xxx",
                "name": "All",
                "peers_count": 3,
                "resources_count": 0
            }
        ],
        "hostname": "MacBook-Pro.local",
        "id": "xxx",
        "inactivity_expiration_enabled": true,
        "ip": "xxx",
        "kernel_version": "24.3.0",
        "last_login": "2025-03-21T10:12:18.479683429Z",
        "last_seen": "2025-03-21T10:50:02.130525774Z",
        "login_expiration_enabled": true,
        "login_expired": false,
        "name": "MacBook-Pro.local",
        "os": "Darwin 15.3.1",
        "serial_number": "xxx",
        "ssh_enabled": false,
        "ui_version": "netbird-desktop-ui/0.38.2",
        "user_id": "vladislav.xxx@xxx",
        "version": "0.38.2"
    },

Considering the dashboard asks for the same information, it's very strange that it's not displayed.
https://github.com/netbirdio/dashboard/blob/main/src/contexts/PeersProvider.tsx#L16
https://github.com/netbirdio/dashboard/blob/main/src/app/(dashboard)/peers/page.tsx#L44