Authorization

URI authorization is supported through Local, RADIUS and TACACS+. URI authorization is performed based on the following attributes:

• URI access method (PUT, POST, DELETE, GET).

• URI (URI string along with the JSON attributes).

• If the URI authorization is not configured for local, radius, tacacs user but URI authorization is enabled, then access to any URI execution is denied. This is the same behavior as command authorization.

• The URI-Access, URI-String and URI-JSON attributes are mandatory. The default value for the URI Exception is permit. Only one attribute is allowed for URI-Access and URI-String .The URI-JSON can have single or multiple attributes with comma as separator.

• If the authentication and authorization methods are different for a user, the authorization URI does not have any impact. This is the same behavior as command authorization.

• The cli_batch URI has encoded attributes that are denied or allowed in the authorized list of URIs. The encoded data is not authorized. Aruba recommends to permit this only on need basis.

• URI authorization is disabled by default like command authorization and must be enabled through aaa authorization command.

• With permit option, all the JSON attributes must match for successful URI execution.

• With deny option, at least one JSON attribute match will result in the denying of URI execution.

• The match is performed only on the JSON attributes and not on the JSON values.

A group for URI authorization must have the following parameters configured:

• URI

• JSON attribute

• URI access method

• permit or deny

A group can be created to have the above configuration for URI authorization for REST interface, or the existing local groups can be extended to configure the REST URIs, JSON strings, and URI access methods. A group can have both command and URI authorizations configured. For the user associated with such a group, URI authorization is applicable for REST interface and command authorization for other supported management interfaces.

The following table illustrates an example for local authorization:

Example URI Executed:
curl -X PUT http://10.100.106.244/rest/v2/vlans 
{"collection_result":{"total_elements_count":1,"filtered_elements_count":1},
"vlan_element":[{"uri":"/vlans/1","vlan_id":1,"name":"DEFAULT_VLAN","status":
"VS_PORT_BASED","type":"VT_STATIC","is_voice_enabled":false,"is_jumbo_enabled":false,
"is_dsnoop_enabled":false,"is_dhcp_server_enabled":false}]}

The following RADIUS VSAs are provided to configure the URI, JSON and Access methods for URI authorization:

• The value for HP-URI-Exception is 0 (permit) and 1 (deny). By default, HP-URI-Exception is permit and is optional.

• The value for HP-URI-Access must be "GET", "POST", "PUT", "DELETE" and ".*"only (".*" refers to all access methods).

• If HP-URI-String is configured with ".*", HP-URI-Json-String must be configured with ".*" only.

• The attributes HP-URI-String, HP-URI-Access, and HP-URI-Exception must be configured with single value and the HP-URI-Json-String can be configured with single or multiple values with comma separator.

• If any of the mandatory VSAs are not configured or if the HP-URI-Json-String is not the last attribute, authentication fails.

• Both command and REST URI authorization parameters can be configured for a user in RADIUS configuration file.

user Cleartext-Password:="user123"
Service-Type = Administrative-User, reply-Message = "Hello",
HP-URI-String = ".*", 
HP-URI-Access = "PUT",
HP-URI-Exception = 1,
HP-URI-Json-String = ".*", 
HP-URI-String += ".*",
HP-URI-Access += "GET",
HP-URI-Json-String += ".*"

The TACACS+ authorization is performed by configuring the rules for the URI authorization in the configuration file on the TACACS+ server. A sample is shown below:

group = admin {
default service = permit service = shell {
priv-lvl = 15
}
deny "/rest/v3/vlans vlan_id name POST" permit .*

}
user = user1 { member = admin
login = cleartext testing service = exec {
priv-lvl = 15
}