Subject: [Netconf] delete-config with NACM

From: Radek Krejčí <[email-masked]>
Date: Fri, 15 Mar 2013 12:42:27 -0400

Hi all,
I'd appreciate a clarification of NACM applied to delete-config
operation. Section 3.2.5 of RFC 6536 talks about necessity of explicit
permission to delete-config operation. My question is - when this is
done, is server still supposed to check "delete" access permissions for
all nodes in the datastore? Or does the explicit permission of
delete-config say "group members are allowed to do it despite the
specific access permissions to the nodes in the datastore"

Radek Krejci

---

From: Andy Bierman <[email-masked]>
Date: Tue, 19 Mar 2013 08:02:41 -0700

> specific access permissions to the nodes in the datastore"

No. If they can delete the datastore you don't need to check
if they can delete specific contents.

We allow <url> datastores and the <startup> config to be deleted.

> Radek Krejci

Andy

---

From: Radek Krejčí <[email-masked]>
Date: Tue, 19 Mar 2013 17:50:46 +0100

> if they can delete specific contents.

thanks Andy, that's how libnetconf do it now.

Radek