We're making API requests to Infoblox Universal DDI and ran into a permissions issue.
Setup: We created an Infoblox API service user with:
- Role:
DDI User Role - User Group:
ib-ddi-user
Issue: This exact configuration is working correctly for one of our existing customers, but fails for a new customer. Since the same role/group setup works for one customer and not the other. We are making calls to the following endpoints as part of this setup:
/api/auditlog/v1/logs/api/ddi/v1/dns/record/api/ddi/v1/dhcp/lease/api/ddi/v1/ipam/address/atlas-logs/v2/logs/api/infra/v1/detail_hosts
The API requests receive an HTTP 403 when accessing the API endpoints, with the response "Request forbidden: not authorized"
Missing roles: After reviewing the Infoblox documentation, we noticed several standard DDI DNS roles appear to be missing from the new customer's CSP portal:
- DDI DNS Auditor Role – can view all DNS resource types
- DDI DNS Manager Role – can administer all DNS resource types
- DDI DNS Operator Role – can administer zones, records, and child zones and view other DNS resource types
- DDI DNS User Role – can administer all DNS record types and view other DNS resource types
Question:
Could someone help us understand what determines which DDI DNS roles are available in a customer's CSP portal, and how that relates to the API permissions needed for access to the endpoints listed above?
