Converted from YANG file 'yuma-nacm.yang' by yangdump version 2.2.1737 Module: yuma-nacm Organization: Netconf Central Version: 2012-01-13 Contact: Andy Bierman <andy@netconfcentral.org>. NETCONF Server Access Control Model /usr/share/yuma/modules/netconfcentral/yuma-nacm.yang Netconf Central Andy Bierman <andy@netconfcentral.org>. 2012-01-13 Add ncx:user-write restriction to prevent user deletion of the nacm container 2010-02-21 Initial version (work-in-progress). General Purpose User Name string. NETCONF Access Rights Read access allowed to all specified data. Any protocol operation or notification that returns data to an application is a read operation. 0 Write access allowed to all specified data. Any protocol operation that alters a database is a write operation. 1 Execution access to the specified RPC operation. Any RPC operation invocation is an exec operation. 2 Type of administrative group that can be assigned to the user, and specified in an access control rule. The identityref data type is used to allow as many groups to be added as needed. There are no standard semantics for each identity. It simply represents a unique group name. Action taken by the server when a particular rule matches. Requested action is permitted. 0 Requested action is denied. 1 Path expression used to represent a special schema-instance identifier string. A schema-instance-identifier value string is an unrestricted YANG instance-identifier expression. All the same rules as an instance-identifier apply except predicates for keys are optional. If a key predicate is missing, then the schema-instance-identifier represents all possible server instances for that key. Parameters for NETCONF Access Control Model. true An empty nacm container indicates that the NACM service is running, and possibly using all default parameters. update Enable or disable all NETCONF access control enforcement. If 'true', then enforcement is enabled. If 'false', then enforcement is disabled. Controls whether read access is granted if no appropriate rule is found for a particular read request. Controls whether write access is granted if no appropriate rule is found for a particular write request. Controls whether exec access is granted if no appropriate rule is found for a particular RPC operation request. Number of times an RPC operation request was denied false Number of times a request to alter a data node was denied. false NACM Group Table One NACM Group Entry system Group identity associated with this entry. Each entry identifies the user name of a member of the group associated with this entry. system NETCONF Access Control Rules. One Module Access Rule. Rules are processed in user-defined order. A module rule is considered a match if the XML namespace for the specified module name matches the XML namespace used within a NETCONF PDU, and the administrative group associated with the requesting session is specified in the 'allowed-group' leaf-list. user Name of the module associated with this rule. Arbitrary name assigned to the access control rule. List of access rights granted to specified administrative groups for the content specified by the associated path. true List of administrative groups which will be assigned the associated access rights for the content specified by the associated path. system A textual description of the access rule. One RPC Operation Access Rule. Rules are processed in user-defined order. An RPC rule is considered a match if the module name of the requested RPC operation matches 'rpc-module-name', the requested RPC operation matches 'rpc-name', and an administrative group associated with the session user is listed in the 'allowed-group' leaf-list user Name of the module defining this RPC operation. Name of the RPC operation. Arbitrary name assigned to the access control rule. List of access rights granted to specified administrative groups for the content specified by the associated path. true List of administrative groups which will be assigned the associated access rights for the content specified by the associated path. system A textual description of the access rule. One Data Access Control Rule. Rules are processed in user-defined order. A data rule is considered to match when the path expression identifies the same node that is being accessed in the NETCONF database, and the administrative group associated with the session is identified in the 'allowed-group' leaf-list. user Arbitrary name assigned to the access control rule. Schema Instance Identifier associated with the data node controlled by this rule. Configuration data or state data instance identifiers start with a top-level data node. A complete instance identifier is required for this type of path value. The special value '/' refers to all possible database contents. true List of access rights granted to specified administrative groups for the content specified by the associated path. true List of administrative groups which will be assigned the associated access rights for the content specified by the associated path. system A textual description of the access rule. One Notification Access Rule. A notification is considered a match if the module name of the requested event type matches 'notification-module-name', the requested event type matches the 'notification-name', and the administrative group associated with the requesting session is listed in the 'allowed-group' leaf-list. user Name of the module defining this notification event type. Name of the notification event. Arbitrary name assigned to the access control rule. List of access rights granted to specified administrative groups for the content specified by the associated path. true List of administrative groups which will be assigned the associated access rights for the content specified by the associated path. system A textual description of the access rule.