IP address permissions

[andershagman]

Hi

I want to restrict permissions for certen groups to add, modify and delete ip addresses in specific prefixes with a certen role.
But there is no prefix__role or parent__role in ipam -> address.

How can I do this?

[dw72]

I have the same problem. Can anyone give a hint on how to do this?

For prefix /24 I used address__startswith but this workaround will not work in all cases.

[candlerb]

IP Address and Prefix have no explicit linkage in the data model.

To find the "parent" prefix, you'd have to either:

1. do a database query which picks all prefixes that enclose the IP, sorted by prefix length, and take the first; or
2. make use of the prefix length (zero off all the bits past the prefix, and search for a prefix that matches this exactly)

However, I've looked in the model and I can't find any property which does either of those.

In the GUI when you view an IP address you can see its parents, but that logic is in the view, not the model.

[andershagman]

One way to go is to create a tenant group "Group 1 and 2" and two tenants "group 1" and "group 2". Where group 1 is the masters and group 2 is the the people with less add, change and delete rights.

Then create three separate permissions.

1. view ip-addresses, prefixes and vrf -> if tenant_group_name = "Group 1 and 2"
2. view tenant -> if tenant_name = "group 2"
3. add, change, delete adresses -> if tenant_name = "group 2"

Add those permissions to group 2.

Put all desired prefixes in tenant "group 2"
Put all forbidden addresses in those prefixes in tenant "group 1". Group 2 can see them but not change them (eg gateway adress).

Group 2 can now add, change and delete addresses as long as they add the right tenant to a new address. They can only choose from one tenant.