Configuration command authorization in model-driven interfaces

Configuration command authorization sends multiple requests that may be the same depending on the configuration changes. In model-driven interfaces, command authorization is required for the following changes to the candidate configuration:

the command that was entered; for example, system name node-2
the resulting configuration changes, because other elements may be modified or deleted; for example, delete router "Base" deletes the entire Base router configuration, and all of the deletions must be authorized

Note:

If the command authorization fails, the resulting configuration changes are not authorized.

Multiple authorization requests are also sent in the following cases:

MD-CLI compound commands, where multiple elements are changed in one command; for example, system name node-2 location NYC or system name node-2 } router router-id 10.1.1.1
configuration changed by an element's YANG modeling constraints, such as "choice" or "when" statements

Setting the system name is an operation that changes one configuration element, as shown in the following example.

Example

[ex:/configure]
A:admin@node-2# system name foo

# Command authorization
cmd=configure 		
cmd-arg=system
cmd-arg=name
# Resulting change authorization
cmd=configure		  
cmd-arg=system
cmd-arg=name

The following log example shows that the memory context and the console command are mutually exclusive, and configuring a new value deletes the existing value. The system must also authorize the deletion.

Note:

Command accounting only logs the command that is entered.

Example: Existing configuration

[ex:/configure log log-id "42" destination]
A:admin@node-2# info
    memory {
    }

Example: Configuration commands

[ex:/configure log log-id "42" destination]
A:admin@node-2# console

Example: Resulting configuration

*[ex:/configure log log-id "42" destination]
A:admin@node-2# info
    console

Example: Command authorization requests

# Command authorization
cmd=configure			
cmd-arg=log
cmd-arg=log-id
cmd-arg=42
cmd-arg=destination
cmd-arg=console
# Resulting change authorization for console
cmd=configure			
cmd-arg=log
cmd-arg=log-id
cmd-arg=42
cmd-arg=destination
cmd-arg=console
# Resulting change authorization for memory
cmd=configure			
cmd-arg=log
cmd-arg=log-id
cmd-arg=42
cmd-arg=destination
cmd-arg=memory