Limited-access admin groups can access certain DHCP resources only if their administrative permissions are defined. By default, the appliance denies access when a limited-access admin group does not have defined permissions. You can grant admin groups read-only or read/write permission, or deny access by using this object.
Only supported resource_type and object combinations are allowed. Refer to the Infoblox NIOS Administrator Guide for more information.
For example, the following resource types are not supported when creating a global permission:
- FILE_DIST_DIRECTORY
- FIXED_ADDRESS_TEMPLATE
- IPV6_NETWORK_CONTAINER
- IPV6_FIXED_ADDRESS_TEMPLATE
- IPV6_NETWORK_TEMPLATE
- IPV6_RANGE_TEMPLATE
- MEMBER_AAA_PROPERTIES
- MEMBER_DHCP_PROPERTIES
- MEMBER_DNS_PROPERTIES
- MEMBER_FILE_DIST_PROPERTIES
- MEMBER_SECURITY_PROPERTIES
- NETWORK_CONTAINER
- NETWORK_TEMPLATE
- RANGE_TEMPLATE
- RESTART_SERVICE
- SUB_GRID_NETWORK_VIEW_PARENT
To create object permission for a specific zone, send the reference in the object field: {“group”: “1”, “permission”: “READ”, “object”: “zone_auth/ZG5zLnpvbmUkLl9kZWZhdWx0LmF6:az/default”}
To create global permission for all IPv6 Network objects, send IPV6_NETWORK in the resource_type field: {“group”: “1”, “permission”: “READ”, “resource_type”: “IPV6_NETWORK”}
To create permission for all IPv4 DHCP ranges inside a specific network container, send the reference in the object field and RANGE in the resource_type field: {“group”: “1”, “permission”: “READ”, “object”: “networkcontainer/ZG5zLm5ldHdvcmtfY29Iui4yMC4wLzI0LzA:2.2.20.0/24/default”, “resource_type”: “RANGE”}
References to permission are object references. The name part of a permission object reference has the following components:
- Group name
- Permission
Example: permission:cname/ZG5zLmJpbmRfY25h:group1/WRITE
The object does not support the following operations:
The object cannot be managed on Cloud Platform members.
These fields are actual members of the object; thus, they can be requested by using _return_fields, if the fields are readable.
The basic version of the object contains the field(s): group, permission, resource_type, role.
The following fields are required to create this object:
| Field | Notes |
|---|---|
| group | One of group or role is required. |
| object | At least one of object or resource_type is required. |
| permission | |
| resource_type | At least one of object or resource_type is required. |
| role | One of group or role is required. |
The name of the admin group this permission applies to.
Type
String.
Create
One of group or role is required.
Search
The field is available for search via
Notes
The group is part of the base object.
A reference to a WAPI object, which will be the object this permission applies to.
Type
String.
This field supports nested return fields as described here.
Create
At least one of object or resource_type is required.
Search
The field is available for search via
The type of permission.
Type
String.
Create
The field is required on creation.
Search
The field is available for search via
Notes
The permission is part of the base object.
The type of resource this permission applies to. If ‘object’ is set, the permission is going to apply to child objects of the specified type, for example if ‘object’ was set to an authoritative zone reference and ‘resource_type’ was set to ‘A’, the permission would apply to A Resource Records within the specified zone.
Type
String.
Create
At least one of object or resource_type is required.
Search
The field is available for search via
Notes
The resource_type is part of the base object.
| Field | Type | Req | R/O | Base | Search |
|---|---|---|---|---|---|
| group | String | Y* | N | Y | = |
| object | String | Y* | N | N | = |
| permission | String | Y | N | Y | = |
| resource_type | String | Y* | N | Y | = |
| role | String | Y* | N | Y | = |
* Required in some cases, see detailed field description above.
