NACM rule to restrict user to access only restconf url

[schallagalla]

Hi All,

I have a action package which should be accessible to particular user. 

I created user and group using nacm and then rule list,, which is taking only "/" as path. if i provide path as /restconf/operations, then i see below error in devel log.

 Error : "/restconf/operations/ep-api/" in access Rule "epp_admin/api_access" is not valid for URN star.

I have not given star in the path given in nacm.

group epp_admin {
user-name [ eppnso ];
}

rule-list epp_admin
group [ epp_admin ];
rule api_access {
module-name *;
path /restconf/operations/ep-api/;
access-operations create,read,update,delete,exec;
action permit;
context *;
}

cmdrule any-command {
action permit;
}

please let me know if anyone encountered this error before?

Thanks.

[yfherzog · Accepted solution]

Hi,

I wasn't able to understand what exactly you're trying to achieve, but 2 comments that might help:

1. I think you can drop the module-name altogether in most cases (I think you might be good with dropping context and access-operations in this case).

2. NACM is mostly API-agnostic, so when you provide the path inside a rule, you typically include the data model path, rather than anything related to the interface to be used (e.g. RESTCONF).

So, in this case, your path might be /ep-api, rather than '/restconf/...'

Hope this might help somehow!

[schallagalla]

Thanks Yftach.

As you said, i removed /restconf/operations and added access to devices. Its working as expected. 

Thanks for your quick reply.