02-24-2020 08:59 AM
Hi,
I am trying to understand if its possible for a non-admin user configured in APIC to have read-only access to REST APIs ?
We sent a REST request as a non-admin user and it returned empty response. Check this API:
The response was -:
-----------GET DATA ---------------------
PATH : /api/node/mo/uni/fabric/connectivityPrefs.json
QueryString : null
Response : {"totalCount":"0","imdata":[]}
-----------END GET DATA ---------------------
Or the user must have admin level privileges ?
Solved! Go to Solution.
02-27-2020 03:39 AM
Gabriel,
Thanks a bunch. That worked. The difference in my setup was I was not creating user with role as admin, I only created it with read-all as role. But APIs need admin role privilege to get any response.
Thanks
neehar
02-24-2020 08:25 PM
02-24-2020 09:06 PM
Thanks Francesco for your response.
I created a read-only user 'readonly' which is part of all security domains - all, common and mgmt. Role assigned is read-all and access is readPriv for all security domains. What do you mean by "to put read-all as rope name" ? Is that something I have missed ?
02-25-2020 07:45 PM
02-25-2020 11:10 PM
Not using any RADIUS authentication. We tried on 2 different APIs - epmMacEp and mgmt:ConnectivityPrefs. For both it failed on 4.2.2f.
Am i missing something here ?
02-26-2020 07:08 PM
02-26-2020 09:07 AM - edited 02-26-2020 09:13 AM
NeeharAthalye,
There is some info missing in how you're creating and sending the request, as well as what roles/privileges you have assigned to the user you're testing with.
With that said, the information you sent below from the API documentation is indeed stating that in order to query this concrete MO, your user must have "read" privileges of role "admin".
For reference, I've defined the following user "ro" that has:
Security Domain - all
Role - admin
Access - Read
Domain "all" having role "admin" with "read" privileges
And with this user, I can do a moquery against the mgmtConnectivityPrefs class:
apic1# whoami ro apic1# moquery -c mgmtConnectivityPrefs Total Objects shown: 1 # mgmt.ConnectivityPrefs annotation : childAction : descr : dn : uni/fabric/connectivityPrefs extMngdBy : interfacePref : inband lcOwn : local modTs : 2019-07-15T18:23:00.407-08:00 name : default nameAlias : ownerKey : ownerTag : rn : connectivityPrefs status : uid : 0
Doing the same type of query from POSTman after logging in as user "ro":
GET https://a.p.i.c/api/node/class/mgmtConnectivityPrefs.json Response: { "totalCount": "1", "imdata": [ { "mgmtConnectivityPrefs": { "attributes": { "annotation": "", "childAction": "", "descr": "", "dn": "uni/fabric/connectivityPrefs", "extMngdBy": "", "interfacePref": "inband", "lcOwn": "local", "modTs": "2019-07-15T18:23:00.407-08:00", "name": "default", "nameAlias": "", "ownerKey": "", "ownerTag": "", "status": "", "uid": "0" } } } ] }
Along these lines, I removed "read" privileges of "admin" role and tried the same query. This resulted in an empty response since user "ro" no longer had read access to that class (which appears to be similar behavior to what you're facing):
apic1# whoami ro apic1# moquery -c mgmtConnectivityPrefs No Mos found
Regards,
Gabriel
02-27-2020 03:39 AM
Gabriel,
Thanks a bunch. That worked. The difference in my setup was I was not creating user with role as admin, I only created it with read-all as role. But APIs need admin role privilege to get any response.
Thanks
neehar
02-27-2020 07:24 PM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide