permission : Permissions object.¶
Limited-access admin groups can access certain DHCP resources only if their administrative permissions are defined. By default, the appliance denies access when a limited-access admin group does not have defined permissions. You can grant admin groups read-only or read/write permission, or deny access by using this object.
Note¶
Only supported resource_type and object combinations are allowed. Refer to the Infoblox NIOS Administrator Guide for more information.
For example, the following resource types are not supported when creating a global permission:
FILE_DIST_DIRECTORY
FIXED_ADDRESS_TEMPLATE
IPV6_NETWORK_CONTAINER
IPV6_FIXED_ADDRESS_TEMPLATE
IPV6_NETWORK_TEMPLATE
IPV6_RANGE_TEMPLATE
MEMBER_AAA_PROPERTIES
MEMBER_DHCP_PROPERTIES
MEMBER_DNS_PROPERTIES
MEMBER_FILE_DIST_PROPERTIES
MEMBER_SECURITY_PROPERTIES
NETWORK_CONTAINER
NETWORK_TEMPLATE
RANGE_TEMPLATE
RESTART_SERVICE
SUB_GRID_NETWORK_VIEW_PARENT
Examples¶
To create object permission for a specific zone, send the reference in the object field: {“group”: “1”, “permission”: “READ”, “object”: “zone_auth/ZG5zLnpvbmUkLl9kZWZhdWx0LmF6:az/default”}
To create global permission for all IPv6 Network objects, send IPV6_NETWORK in the resource_type field: {“group”: “1”, “permission”: “READ”, “resource_type”: “IPV6_NETWORK”}
To create permission for all IPv4 DHCP ranges inside a specific network container, send the reference in the object field and RANGE in the resource_type field: {“group”: “1”, “permission”: “READ”, “object”: “networkcontainer/ZG5zLm5ldHdvcmtfY29Iui4yMC4wLzI0LzA:2.2.20.0/24/default”, “resource_type”: “RANGE”}
Object Reference¶
References to permission are object references. The name part of a permission object reference has the following components:
Group name
Permission
Example: permission:cname/ZG5zLmJpbmRfY25h:group1/WRITE
Restrictions¶
The object does not support the following operations:
Global search (searches via the search object)
Scheduling
CSV export
The object cannot be managed on Cloud Platform members.
Fields¶
These fields are actual members of the object; thus, they can be requested by using _return_fields, if the fields are readable.
The basic version of the object contains the field(s): group, permission, resource_type, role.
The following fields are required to create this object:
Field |
Notes |
---|---|
group |
One of group or role is required. |
object |
At least one of object or resource_type is required. |
permission |
|
resource_type |
At least one of object or resource_type is required. |
role |
One of group or role is required. |
group¶
- group¶
The name of the admin group this permission applies to.
Type
String.
Create
One of group or role is required.
Search
The field is available for search via
‘=’ (exact equality)
Notes
The group is part of the base object.
object¶
- object¶
A reference to a WAPI object, which will be the object this permission applies to.
Type
String.
This field supports nested return fields as described here.
Create
At least one of object or resource_type is required.
Search
The field is available for search via
‘=’ (exact equality)
permission¶
- permission¶
The type of permission.
Type
String.
- Valid values are:
DENY
READ
WRITE
Create
The field is required on creation.
Search
The field is available for search via
‘=’ (exact equality)
Notes
The permission is part of the base object.
resource_type¶
- resource_type¶
The type of resource this permission applies to. If ‘object’ is set, the permission is going to apply to child objects of the specified type, for example if ‘object’ was set to an authoritative zone reference and ‘resource_type’ was set to ‘A’, the permission would apply to A Resource Records within the specified zone.
Type
String.
- Valid values are:
A
AAAA
AAA_EXTERNAL_SERVICE
ADD_A_RR_WITH_EMPTY_HOSTNAME
ALIAS
BFD_TEMPLATE
BULKHOST
CAA
CA_CERTIFICATE
CLUSTER
CNAME
CSV_IMPORT_TASK
DASHBOARD_TASK
DATACOLLECTOR_CLUSTER
DEFINED_ACL
DELETED_OBJS_INFO_TRACKING
DEVICE
DHCP_FINGERPRINT
DHCP_LEASE_HISTORY
DHCP_MAC_FILTER
DNAME
DNS64_SYNTHESIS_GROUP
FILE_DIST_DIRECTORY
FIREEYE_PUBLISH_ALERT
FIXED_ADDRESS
FIXED_ADDRESS_TEMPLATE
GRID_AAA_PROPERTIES
GRID_ANALYTICS_PROPERTIES
GRID_DHCP_PROPERTIES
GRID_DNS_PROPERTIES
GRID_FILE_DIST_PROPERTIES
GRID_REPORTING_PROPERTIES
GRID_SECURITY_PROPERTIES
HOST
HOST_ADDRESS
HSM_GROUP
IDNS_CERTIFICATE
IDNS_GEO_IP
IDNS_LBDN
IDNS_LBDN_RECORD
IDNS_MONITOR
IDNS_POOL
IDNS_SERVER
IDNS_TOPOLOGY
IMC_AVP
IMC_PROPERTIES
IMC_SITE
IPV6_DHCP_LEASE_HISTORY
IPV6_FIXED_ADDRESS
IPV6_FIXED_ADDRESS_TEMPLATE
IPV6_HOST_ADDRESS
IPV6_NETWORK
IPV6_NETWORK_CONTAINER
IPV6_NETWORK_TEMPLATE
IPV6_RANGE
IPV6_RANGE_TEMPLATE
IPV6_SHARED_NETWORK
IPV6_TEMPLATE
KERBEROS_KEY
MEMBER
MEMBER_ANALYTICS_PROPERTIES
MEMBER_CLOUD
MEMBER_DHCP_PROPERTIES
MEMBER_DNS_PROPERTIES
MEMBER_FILE_DIST_PROPERTIES
MEMBER_SECURITY_PROPERTIES
MSSERVER
MS_ADSITES_DOMAIN
MS_SUPERSCOPE
MX
NAPTR
NETWORK
NETWORK_CONTAINER
NETWORK_DISCOVERY
NETWORK_TEMPLATE
NETWORK_VIEW
OCSP_SERVICE
OPTION_SPACE
PORT_CONTROL
PTR
RANGE
RANGE_TEMPLATE
RECLAMATION
REPORTING_DASHBOARD
REPORTING_SEARCH
RESPONSE_POLICY_RULE
RESPONSE_POLICY_ZONE
RESTART_SERVICE
RESTORABLE_OPERATION
ROAMING_HOST
RULESET
SAML_AUTH_SERVICE
SCHEDULE_TASK
SG_IPV4_NETWORK
SG_IPV6_NETWORK
SG_NETWORK_VIEW
SHARED_A
SHARED_AAAA
SHARED_CNAME
SHARED_MX
SHARED_NETWORK
SHARED_RECORD_GROUP
SHARED_SRV
SHARED_TXT
SRV
SUB_GRID
SUB_GRID_NETWORK_VIEW_PARENT
SUPER_HOST
TEMPLATE
TENANT
TLSA
TXT
Unknown
VIEW
VLAN_OBJECTS
VLAN_RANGE
VLAN_VIEW
ZONE
Create
At least one of object or resource_type is required.
Search
The field is available for search via
‘=’ (exact equality)
Notes
The resource_type is part of the base object.
role¶
- role¶
The name of the role this permission applies to.
Type
String.
Create
One of group or role is required.
Search
The field is available for search via
‘=’ (exact equality)
Notes
The role is part of the base object.
Fields List¶
Field |
Type |
Req |
R/O |
Base |
Search |
---|---|---|---|---|---|
group |
String |
Y* |
N |
Y |
= |
object |
String |
Y* |
N |
N |
= |
permission |
String |
Y |
N |
Y |
= |
resource_type |
String |
Y* |
N |
Y |
= |
role |
String |
Y* |
N |
Y |
= |
* Required in some cases, see detailed field description above.