XML API security features controlled through the NFM-P client GUI

Overview

A system administrator can use the security management forms in the NFM-P client GUI to control the following security-related features for XML API:

• User account privileges

• Session monitoring

• Session shutdown

• SNMPv3 for secure NE polling

• RADIUS, LDAP, and TACACS+ authentication for NFM-P users

• Session logs of NFM-P client GUI and OSS activity; the XML API client ID must use the JMS client ID format described in JMS subscriptions to be uniquely identified as a XML API session.

You must create a scope of command profile to group the OSS Management scope of command role with additional roles. Otherwise, the NFM-P returns the SOAP exception message shown in the following figure :

Figure 3-3: SOAP exception message, insufficient privileges

<?xml version="1.0" encoding="UTF-8"?>

<SOAP:Envelope xmlns:SOAP="http://schemas.xmlsoap.org/soap/envelope/">

   <SOAP:Header>

      <header xmlns="xmlapi_1.0">

         <requestID>XML_API_client@n</requestID>

         <requestTime>Sep 22, 2015 3:13:08 PM</requestTime>

         <responseTime>Sep 22, 2015 3:13:08 PM</responseTime>

      </header>

   </SOAP:Header>

   <SOAP:Fault>

      <faultcode>SOAP:Client</faultcode>

      <faultstring>[security] Users require OSS Management privileges to use XML API.</faultstring>

      <faultactor>XmlApi</faultactor>

      <detail>

         <requestID>XML_API_client@n</requestID>

      </detail>

   </SOAP:Fault>

</SOAP:Envelope>

See the chapter on NFM-P user security in the NSP System Administrator Guide for information about managing NFM-P user security.

If a user supplies an incorrect username or password, or if the username or password is missing, the NFM-P returns the SOAP exception message shown in the following figure:

Figure 3-4: SOAP exception message, login failure

<?xml version="1.0" encoding="UTF-8"?>

<SOAP:Envelope xmlns:SOAP="http://schemas.xmlsoap.org/soap/envelope/">

   <SOAP:Header>

      <header xmlns="xmlapi_1.0">

         <requestID>XML_API_client@n</requestID>

         <requestTime>Sep 22, 2015 3:13:08 PM</requestTime>

         <responseTime>Sep 22, 2015 3:13:08 PM</responseTime>

      </header>

   </SOAP:Header>

   <SOAP:Fault>

      <faultcode>SOAP:Client</faultcode>

      <faultstring>[security] Login failure.</faultstring>

      <faultactor>XmlApi</faultactor>

      <detail>

         <requestID>XML_API_client@n</requestID>

      </detail>

   </SOAP:Fault>

</SOAP:Envelope>

If a user is not assigned the appropriate scope of command privilege for a class type, or span of control for an object, an exception is returned.

See the NSP System Administrator Guide for information about how listing is filtered by span, and configuration is span-enforced.

Unlike in HTTP or HTTPS where span of control rules are implicitly enforced, span of control rules are not implicitly enforced via JMS. JMS requires the administrator to explicitly specify the required span IDs within the JMS filter. For example, without the correct JMS filter, it may not be possible to listen to events from objects that are not in the users span of control.

Table 3-1: Example JMS filter entries