Forum Discussion
Operator Role for user with only API permission
Hello.
My question is : Is it possible to create an user and granted Operator Role but ONLY allow it to use API calls ?
We would like to denied the access to the web interface but without blocking web resources through API for the Operator role.
Thanks in advance.
Why do you use -l parameter ? It's mean listen so, your commands wait for connexion and send your binary payload.
The nc error message tell you that you can't listen on an interface you don't own. Till now, I didn't know we could specify the address. :p
But what you do there is not what I wanted to explain to you in my first post. I told you (but not clearly, i admit :p) that you could use regular TCP monitor in TMSH or GUI. In the field Send String and in the field Receive String you can actually use the escaped string. ;) More simple than with the nc script no ?
1 Reply
- gersbah
Cirrostratus
From what I read and from all my testing, the answer appears to be "no".
See https://devcentral.f5.com/s/articles/icontrol-rest-fine-grained-role-based-access-control-30773
"The role is important. When the access privileges conflict between the role and the fine grained RBAC, the stricter authorization is chosen. For example, if the RBAC is configured to allow PATCH or POST but the user's role is guest (no alteration allowed), the user won't be able to perform these methods."
To be honest, I'm very confused about this, because it seems to make the entire concept of fine-grained API access more or less pointless. If the API user can still be used to log in interactively with full access rights according to the user role, why would I even bother to define more granular API rights?
But maybe I'm just missing something. Happy to hear any counterpoints.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com