Re: [netconf] Identity of an OAM user behind ONAP or NMS

[Jan Lindblad <[e-mail]>]

Balász,

> Hello,
> We have systems where the Netconf client is actually a bigger management system like ONAP or a Network Management system (NMS). These systems have their own user management and access control with potentially many dozens of OAM users that can handle thousands of nodes. We do not want create and maintain these dozens of users in thousands of nodes. The idea is to have a single NMS user that has superuser rights and leave the access control to the NMS.
> However, this presents a problem: The Netconf server does not have the effective user identity who ordered the action in NMS. Still it would be good to include this effective userId in the audit trail logs on the Netconf server.
>  
> IS there some standard way to send such a second effective-user-id to the Netconf server? Would there be interest for defining such a mechanism?

This is one of the areas where operators' choices vary greatly, in my experience. The most common basic approach, as far as I have seen, is to actually use the real user id towards devices. If nothing else, so for auditing purposes. In order not to have to store user credentials on thousands of nodes, which as you say would be a problem, remote authentication protocols like Radius, LDAP or TACACS+ are configured on the nodes.

Best Regards,
/jan