For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

VuongLe76_31178's avatar
VuongLe76_31178
Icon for Nimbostratus rankNimbostratus
May 09, 2017

Limited rights for user API

How I can limited rights with user that use for API ? I want user API can only access: / --> GET /* --> GET,PATCH //* --> GET, PATCH, DELETE. When I create new user via tmsh or GUI --> minimun righ...
BIG-IP
security
TMSH
Arnaud_Lemaire's avatar
Arnaud_Lemaire
Icon for Employee rankEmployee
Jun 07, 2017

Yes you can do it exclusively through the rest API. here is an example of icontrol role creation.

POST https://192.168.142.17/mgmt/shared/authz/roles/
{
"name": "my_icontrol_group",
  "userReferences": [
    {
      "link": "https://localhost/mgmt/shared/authz/users/my_rest_user"
    }
  ],
  "resources": [
    {
      "resourceMask": "/mgmt/tm/ltm/pool/~Common~pool_turnkey/members",
      "restMethod": "GET"
    },
    {
      "resourceMask": "/mgmt/tm/ltm/pool/~Common~pool_turnkey/members/*",
      "restMethod": "PUT"
    },
    {
      "resourceMask": "/mgmt/tm/ltm/pool/~Common~pool_turnkey/members/*",
      "restMethod": "PATCH"
    }
  ]
}
  • Where my_icontrol_group is the name of the role.
  • user references point to a group of users or here a single (or list of) user.
  • resources define which uri in the API are available with which method.