{"action":"opened","issue":{"url":"https://api.github.com/repos/CESNET/netopeer/issues/143","repository_url":"https://api.github.com/repos/CESNET/netopeer","labels_url":"https://api.github.com/repos/CESNET/netopeer/issues/143/labels{/name}","comments_url":"https://api.github.com/repos/CESNET/netopeer/issues/143/comments","events_url":"https://api.github.com/repos/CESNET/netopeer/issues/143/events","html_url":"https://github.com/CESNET/netopeer/issues/143","id":191640013,"number":143,"title":"edit-config permission denied after add username to NACM","user":{"login":"miaofenk","id":21357015,"avatar_url":"https://avatars.githubusercontent.com/u/21357015?v=3","gravatar_id":"","url":"https://api.github.com/users/miaofenk","html_url":"https://github.com/miaofenk","followers_url":"https://api.github.com/users/miaofenk/followers","following_url":"https://api.github.com/users/miaofenk/following{/other_user}","gists_url":"https://api.github.com/users/miaofenk/gists{/gist_id}","starred_url":"https://api.github.com/users/miaofenk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/miaofenk/subscriptions","organizations_url":"https://api.github.com/users/miaofenk/orgs","repos_url":"https://api.github.com/users/miaofenk/repos","events_url":"https://api.github.com/users/miaofenk/events{/privacy}","received_events_url":"https://api.github.com/users/miaofenk/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-11-25T07:28:17Z","updated_at":"2016-11-25T07:28:17Z","closed_at":null,"body":"Hi,\r\n\r\nI created a new account \"netconf\" to do netopeer-cli operations. The account write access is modified in NACM using netopeer-configurator, following is NACM configurator status:\r\n\r\n> Access control is ON  \r\n> Using system groups is ALLOWED   \r\n> Default action for read requests: PERMIT \r\n> Default action for write requests: PERMIT\r\n> Default action for execute requests: PERMIT\r\n> Add users with unlimited access        \r\n> netconf                                                                                                                                \r\n> Show current NACM rules. \r\n\r\nThe content of datastore-acm.xml:\r\n\r\n> <?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n> <datastores xmlns=\"urn:cesnet:tmc:datastores:file\">\r\n>   <running lock=\"\"/>\r\n>   <startup lock=\"\">\r\n>     <nacm xmlns=\"urn:ietf:params:xml:ns:yang:ietf-netconf-acm\">\r\n>       <rule-list>\r\n>         <name>almighty</name>\r\n>         <group>almighty</group>\r\n>         <rule>\r\n>           <name>almighty</name>\r\n>           <module-name>*</module-name>\r\n>           <access-operations>*</access-operations>\r\n>           <action>permit</action>\r\n>         </rule>\r\n>       </rule-list>\r\n>       <write-default>permit</write-default>\r\n>       <groups>\r\n>         <group>\r\n>           <name>almighty</name>\r\n>           <user-name>netconf</user-name>\r\n>         </group>\r\n>       </groups>\r\n>       <enable-nacm>true</enable-nacm>\r\n>     </nacm>\r\n>   </startup>\r\n>   <candidate modified=\"false\" lock=\"\"/>\r\n> </datastores>\r\n\r\nHowever, the edit-config operation still failed due to permission issue. \r\nThe netopeer-server log:\r\n\r\n> netopeer-server[11346]: Created session 33 for user 'netconf' (UID 1001)\r\n> netopeer-server[11346]: New server session for 'netconf' with ID 33\r\n> netopeer-server[11346]: Received message (session 33): <?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n> <rpc xmlns=\"urn:ietf:params:xml:ns:netconf:base:1.0\" message-id=\"1\">\r\n>   <edit-config>\r\n>     <target>\r\n>       <candidate/>\r\n>     </target>\r\n>     <config>\r\n>       <system xmlns=\"http://nokia.com/AA/csf\" xmlns:xc=\"urn:ietf:params:xml:ns:netconf:base:1.0\">\r\n>         <nonvnfc>\r\n>           <configkey xc:operation=\"replace\">\r\n>             <cfgPATH>config/BR/backup_ip_type</cfgPATH>\r\n>             <subdirname>config/BR</subdirname>\r\n>             <cfgvalue><![CDATA[IPv4]]></cfgvalue>\r\n>             <timestamp><![CDATA[<datetime>]]></timestamp>\r\n>           </configkey>\r\n>         </nonvnfc>\r\n>       </system>\r\n>     </config>\r\n>   </edit-config>\r\n> </rpc>\r\n> netopeer-server[11346]: Writing message (session 33): <?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n> <rpc-reply xmlns=\"urn:ietf:params:xml:ns:netconf:base:1.0\" message-id=\"1\">\r\n>   <rpc-error>\r\n>     <error-type>application</error-type>\r\n>     <error-tag>access-denied</error-tag>\r\n>     <error-severity>error</error-severity>\r\n>     <error-message>replacing \"configkey\" data node is not permitted.</error-message>\r\n>   </rpc-error>\r\n> </rpc-reply>\r\n\r\nCould you please let me know what I did wrong to set access type for a new account?\r\nThanks a lot!\r\n\r\nBest Regards,\r\nMiaofeng"}}
{"actor":{"display_login":"miaofenk"}}