Can I define users who only have monitoring rights, or who can manage only specific vServices?

Short answer

Yes. In the Settings → User Management → Device Users → Add form, the role is selected with User Type: for monitoring only, Monitor User (Load Balancer and WAF screens read-only) or Read-only User (all areas read-only) is used, and for managing specific vServices, Traffic User (Traffic+WAF User if WAF is also needed). In the User vServices field that opens in these roles, the vServices the user can view or edit are selected; in Monitor user and Read-only user, if the field is left empty there is no restriction, and in Traffic user at least one vService is selected. Traffic user edits only the assigned vServices and cannot add or delete vServices; for it to be able to edit Backend Services, Backend Service Permission is turned on. Objects that are also used in other vServices cannot be changed by these users.

Problem: Everyone Can Manage the Entire Device

It is required that the monitoring team only looks at the screens and that the application teams manage only their own vServices. When all users are given full permission, a change by one team can also affect the services of other teams.

Solution: Four Methods

The role is given when the user is added one by one (Methods 1, 2, 4) or automatically for users logging in from the directory for the first time (Method 3).

Your situation	Suitable method
The user will only monitor	Method 1: Monitoring User
The user will manage specific vServices	Method 2: vService-Scoped Manager
Users log in with LDAP, RADIUS or TACACS	Method 3: Automatic User Creation
Creating the user from the command line	Method 4: WEB-CLI

Method 1: Monitoring User Recommended

• How it works The read-only role shows the screens and does not allow changes; the vServices seen can be limited with User vServices.
• Where it is openedDevice Users → Add → User Type = Monitor user or Read-only user
• Requirement Full permission in the Users area on the account that adds the user; among the built-in roles, only Admin has it.
• Scope Monitor user: Load Balancer and WAF screens · Read-only user: all areas

Step-by-Step Configuration

1

Adım 1 Open the Device Users screen

Configuration Menu → Settings → User Management → Device Users is opened.

2

Adım 2 Click the Add button

The Add button is clicked; the user add form opens (How to add).

3

Adım 3 Select the role

In the User Type field, Monitor User (only the Load Balancer and WAF screens) or Read-only User (all areas) is selected.

4

Adım 4 Enter the credentials

Username, Authorization Source and, with the Local source, Password and Password (again) are entered.

5

Adım 5 Select the vServices to be seen

If needed, the vServices the user will see are checked in the User vServices field; if it is left empty, all vServices are seen.

6

Adım 6 Save

The Add button at the bottom of the form is clicked.

Verification

1LoginTR7 side

A login is made with the new user and Load Balancer vService List is opened.

ExpectedOnly the vServices selected in User vServices are listed

Method 2: vService-Scoped Manager

• How it works Traffic user sees and edits only the vServices assigned in the User vServices field; it cannot add or delete vServices.
• Where it is openedDevice Users → Add → User Type = Traffic user or Traffic+WAF user
• Requirement Full permission in the Users area on the account that adds the user; the vServices to be assigned must have been created beforehand.
• Scope The assigned vServices

Step-by-Step Configuration

1

Adım 1 Open the Device Users screen

Configuration Menu → Settings → User Management → Device Users is opened.

2

Adım 2 Click the Add button

The Add button is clicked.

3

Adım 3 Select the role

In the User Type field, Traffic User is selected; if the user will also manage the WAF settings, Traffic+WAF User is selected.

4

Adım 4 Enter the credentials

Username, Authorization Source and, with the Local source, the password fields are filled in.

5

Adım 5 Select the scope

At least one vService is checked in the User vServices field. For the user to be able to edit Backend Services, Backend Service Permission is turned on, and to be able to select certificates in vServices, Certificate Selection is turned on; both are off by default. Details of the scope switches: How do I make sure a user edits only the vServices assigned to them and does not touch Backend Services and certificates?

6

Adım 6 Save

The Add button at the bottom of the form is clicked.

Verification

1LoginTR7 side

A login is made with the new user and Load Balancer vService List is opened.

ExpectedOnly the assigned vServices are listed and can be edited

Method 3: Automatic User Creation

• How it works While Automatic User Creation is on, a user logging in with LDAP, RADIUS or TACACS for the first time is created with the role in the Default User Type to Create field.
• Where it is openedDevice Users → User Management Settings tab
• Requirement A defined LDAP, RADIUS or TACACS authentication setting.
• Scope All users logging in from the directory for the first time

Step-by-Step Configuration

1

Adım 1 Open the User management settings tab

On the Device Users screen, the User Management Settings tab is opened and the edit form is opened.

2

Adım 2 Turn on automatic creation

Automatic User Creation is turned on and, in the User Creation Source field, the source the users come from (LDAP, RADIUS, TACACS) is selected; at least one source must be selected.

3

Adım 3 Select the default role

In the Default User Type to Create field, Read-only User (default) or Monitor User is selected for monitoring.

4

Adım 4 Save

The Save button is clicked.

Verification

1LoginTR7 side

The first login is made with a directory user; the User type value of the user in the Device Users list is checked.

ExpectedThe role selected in Default user type to create

Method 4: WEB-CLI

• How it works The users add command creates the user with its role and vService scope (users · The Authorization Areas).
• Where it is openedWEB-CLI
• Requirement CLI access and full permission in the Users area on the account that runs the command.
• Scope A single user

Step-by-Step Configuration

1

Adım 1 Create the monitoring user

The role (userType) and the username are required fields; the vService name is listed with Tab. The password is asked hidden when the command is run:

users add userType monitor username izleme1 --userPools.0 <vService>

2

Adım 2 Create the vService manager

For Traffic user, --backendPermission true turns on the permission to edit Backend Services:

users add userType trafficUser username ekip1 --userPools.0 <vService> --backendPermission true

Certificate Selection is not available in WEB-CLI; if needed, it is turned on from the edit form of the user in the interface after the user is created.

Verification

1UserTR7 side

The new user is checked in the Device Users list.

ExpectedUser type and User vServices as in the command

Common Mistakes

• Expecting Traffic user to open a new vService. Traffic user cannot add or delete vServices; vServices are created by Admin, Traffic manager or Traffic+WAF manager.
• Leaving User vServices empty in Monitor user or Read-only user and assuming the user is restricted. An empty field means there is no restriction.
• Assuming a shared profile or Backend Service can be edited by Traffic user. Objects that are also used in other vServices cannot be changed or deleted.
• Not checking the default role in Automatic user creation. Everyone logging in from the directory for the first time is created with this role.

How it is done in the documentation

• Device Users · User Types
• Device Users · Authorization / Scope Fields
• Device Users · How to Add?
• users · The Authorization Areas

Related questions

• How do I make sure a user edits only the vServices assigned to them and does not touch Backend Services and certificates?
• Can I see who made changes and when?
• Where do I monitor the current status of my vService?