Forum Discussion
safiyet_80777
Mar 29, 2011Nimbostratus
user permission
Hi,
We want to show user interface of f5 bigip to a user,a role or a partition differently. We want to prevent that some users can not look at some datas or be changed some configuration. For example for user "test", we want to disable system->Configuration->local traffic page with a perl script, changing icontrol,etc. Is this possible with ICONTROL? or how we do this?
Thanks..
- JRahmAdminIt's possible, but I think differently than you are expecting. Before I go further, are you familiar with creating administrative partitions in the GUI, which allow by object and by role what a user can see/change? It'd be a worthwhile exercise to explore that first. If that doesn't meet your needs, then you're looking at a custom application (web-based or desktop) that will restrict what a user can see based on the options you control through iControl interface/method calls. This application would exist off-box, either on a server or on a desktop. There are some examples in perl linked here: http://devcentral.f5.com/wiki/default.aspx/iControl/Perl.html Click Here
- safiyet_80777NimbostratusThanks Jason,
- JRahmAdminiControl is just an interface to the BIG-IP to make sysetm and configuration changes. I don't believe adding new roles or customizing existing roles is supported. Only way I'm familiar with to do something like this is to write a script/application that uses iControl and "hides" the features you don't want to give users access to by not including them in your application, or at least restricting them by user.
- safiyet_80777Nimbostratus
- hooleylistCirrostratusThe idea is that you create a custom application using the language or your choice. With that application you only allow users to execute specific operations that you want. In effect, you're replacing the default admin tools like the GUI or the command line. You're not modifying the default admin GUI or CLI behavior on LTM.
- safiyet_80777Nimbostratusyourealize me exactly. My main question is how do I replace the default admin tools?
- hooleylistCirrostratusYou would build a tool which provides only the admin operations you want to allow using iControl calls and then disallow access to the default admin interfaces (the web GUI and command line).
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects