topic Read-Only account for Gaia API? in API / CLI Discussion

Read-Only account for Gaia API?

Maarten_Sjouw — Tue, 24 Sep 2019 05:55:55 GMT

For the GAIA API we are trying to create a role that allows the users to only use show commands, but currently all we can get working is a user with the full admin role. In our case we are using TacAcs authentication and the role associated to this also needs to be assigned otherwise it will not work.

Any idea how to configure the role for a Read-Only API user?

Re: Read-Only account for Gaia API?

Martin_Valenta — Tue, 24 Sep 2019 08:42:18 GMT

MonitorRole doesn't work when attached to that user?

Re: Read-Only account for Gaia API?

Maarten_Sjouw — Tue, 24 Sep 2019 08:49:07 GMT

Nope.

Re: Read-Only account for Gaia API?

Martin_Valenta — Thu, 26 Sep 2019 11:15:50 GMT

Did you got some answer from TAC?

Re: Read-Only account for Gaia API?

Maarten_Sjouw — Thu, 26 Sep 2019 11:17:58 GMT

Did not open a case yet.

Re: Read-Only account for Gaia API?

Maarten_Sjouw — Wed, 23 Oct 2019 11:25:58 GMT

@Tal_Martsiano would you like to comment on this?

Re: Read-Only account for Gaia API?

Nick_Doropoulos — Sat, 23 Nov 2019 20:34:26 GMT

Have you got a solution for this yet? I am very interested in setting up a similar account too.

Thanks.

Re: Read-Only account for Gaia API?

JozkoMrkvicka — Sat, 23 Nov 2019 21:20:16 GMT

You can create a new RBA role where only "show configuration" will be allowed. This is not related to API, but for GAIA permissions only.

add rba role show_only domain-type System readonly-features configuration add rba user <AFFECTED_USER> roles show_only

Try to play with webUI and Roles there. Specify only commands you want to allow and simply flag it as "read only".