[Netconf] Question on NACM usage

["Bogaert, Bart (Nokia - BE)" <[e-mail]>]

Hi

 

I would like to continue on one of the examples given in the appendix of the
NACM RFC:

 

       <rule>

         <name>permit-dummy-interface</name>

         <path xmlns:acme="http://example.com/ns/itf">

           /acme:interfaces/acme:interface[acme:name='dummy']

         </path>

         <access-operations>read update</access-operations>

         <action>permit</action>

         <comment>

           Allow the limited and guest groups read

           and update access to the dummy interface.

         </comment>

       </rule>

 

I am assuming that this rule allows read and update access to all leaves of
the data node identified by the path, so it would allow to update a specific
leaf of that data node.  Is my understanding correct?

Another question I have is related to the XPATH itself.  In the above
example I think that the name leaf is the key of the list.  Can we use
another leaf to identify a data node and allow specific access to that data
node?

Assume that there would be a leaf called 'pool-id' which can take values
from 1 to 10, could the XPATH look like below?

 

         <path xmlns:acme="http://example.com/ns/itf">

           /acme:interfaces/acme:interface[acme:pool-id=5]

         </path>

 

We would like to allow/deny access to data nodes (and the leafs of that data
node) to groups based on the value of the pool-id.  Is the above the correct
way to express the access control?

 

Best regards - Vriendelijke groeten,

Bart Bogaert

Broadband-Access System Architect Data

Contact number [phone] ([phone])

 

NOKIA

Copernicuslaan 50, 2018 Antwerp, Belgium