For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

prole92_221949's avatar
prole92_221949
Icon for Cirrus rankCirrus
Jul 13, 2016
Solved

BIG-IP 11.6.1 iControl REST API access issues

Hi guys,   I'm having issues with BIG-IP version 11.6.1 and iControl REST API. On previous versions I was able to create an administrator account on the BIG-IP and use it to access the iControl RE...
11.6.1
application delivery
BIG-IP
iControlREST
  • Tikka_Nagi_1315's avatar
    Tikka_Nagi_1315
    Jul 14, 2016

    The behavior changed as part of an enhancement to allow role based access to REST resources. You can create different users as follows:

     

    1. Create new user in GUI or TMSH. Make sure to assign that user the appropriate role (e.g. Manager, etc)
    2. GET to /mgmt/shared/authz/users to verify that the user shows up in the users
    3. GET /mgmt/shared/authz/roles/iControl_REST_API_User and save contents
    4. Update userReferences property from the role resource you got in step 3 "userReferences": [ { "link": "https://localhost/mgmt/shared/authz/users/" }
    5. Do a PUT (or PATCH) to /mgmt/shared/authz/roles/iControl_REST_API_User with the modified userReferences array property
    6. Verify that the role is updated with the user reference: GET /mgmt/shared/authz/roles/iControl_REST_API_User
    7. Perform an icontrol command with that user to verify

    Note: if the role that you assigned in step 1 does not have access to a resource then you still won’t be able to read/write it

     

Tikka_Nagi_1315's avatar
Tikka_Nagi_1315
Historic F5 Account
Jul 14, 2016

The behavior changed as part of an enhancement to allow role based access to REST resources. You can create different users as follows:

 

  1. Create new user in GUI or TMSH. Make sure to assign that user the appropriate role (e.g. Manager, etc)
  2. GET to /mgmt/shared/authz/users to verify that the user shows up in the users
  3. GET /mgmt/shared/authz/roles/iControl_REST_API_User and save contents
  4. Update userReferences property from the role resource you got in step 3 "userReferences": [ { "link": "https://localhost/mgmt/shared/authz/users/" }
  5. Do a PUT (or PATCH) to /mgmt/shared/authz/roles/iControl_REST_API_User with the modified userReferences array property
  6. Verify that the role is updated with the user reference: GET /mgmt/shared/authz/roles/iControl_REST_API_User
  7. Perform an icontrol command with that user to verify

Note: if the role that you assigned in step 1 does not have access to a resource then you still won’t be able to read/write it