Configures a custom privilege for role-based access control, allowing assignment of read or write permissions to managed object classes not covered by predefined privileges.
Provides instructions for configuring a custom privilege, enabling read or read/write access to managed objects (MOs) that are not included in predefined privileges.
Managed object classes are described in the Cisco APIC Management Information Model Reference . For each MO class, the reference lists the predefined roles that have read or read/write privileges for that class.
For each predefined privilege, you can see a list of MO classes and the read/write permission by using the Cisco APIC Roles and Privileges Matrix .
To configure a custom privilege with read or write access permission to an MO class, you must use the APIC REST API. For instructions on using the API, see the Cisco APIC REST API Configuration Guide .
Procedure
aaa:RbacClassPriv.
Example:
This example shows how to configure the custom privilege custom-privilege-1 with both read and write access to objects of the class fabric:Pod .
POST https://<APIC-IP>/api/node/mo/uni/rbacdb/rbacclpriv-<moClassName>.json
{
"aaaRbacClassPriv":
{
"attributes":
{
"name": "<moClasssName>",
"wPriv": "<privilege>",
"rPriv": "<privilege>"
}
}
}
In the moClassName value of the URI, include the name of the object class for which you are configuring access.
In the payload, provide the following attributes:
-
name: Name of the object class for which you are configuring access. -
wPriv: Name of the custom privilege that will include write access to objects of the class. -
rPriv: Name of the custom privilege that will include read access to objects of the class.
To assign read and write access to a custom privilege, enter the name of the custom privilege in both wPriv and rPriv .