How do I make sure a user edits only the vServices assigned to them and does not touch Backend Services and certificates?

Q: How do I make sure a user edits only the vServices assigned to them and does not touch Backend Services and certificates?

In the Settings → User Management → Device Users → Add form, Traffic User (Traffic+WAF User if WAF is also needed) is selected as the User Type, and the vServices the user can manage are marked in the User vServices field; the user sees and edits only these, and cannot add new vServices or delete them. While Backend Service Permission is off, the user cannot add or edit in the Backend Service table in the vService form; while Certificate Selection is off, the user cannot select a certificate in the vService. Profiles and Backend Services that are also used in other vServices cannot be changed or deleted by this user; thus the traffic of other teams is not affected. The user restriction is at the vService level; there is no user restriction based on frontend IP or backend network.

Short answer

In the Settings → User Management → Device Users → Add form, Traffic User (Traffic+WAF User if WAF is also needed) is selected as the User Type, and the vServices the user can manage are marked in the User vServices field; the user sees and edits only these, and cannot add new vServices or delete them. While Backend Service Permission is off, the user cannot add or edit in the Backend Service table in the vService form; while Certificate Selection is off, the user cannot select a certificate in the vService. Profiles and Backend Services that are also used in other vServices cannot be changed or deleted by this user; thus the traffic of other teams is not affected. The user restriction is at the vService level; there is no user restriction based on frontend IP or backend network.

Problem: Team Users Can Change Other People's Services

In environments where different application teams use the same TR7 device, it is desired that each user manages only their own vServices and cannot touch the shared Backend Services, profiles and certificates.

Solution

Traffic User and Scope Switches

How it works The Traffic User role gives the modify permission in the Load Balancer area; User vServices, Backend Service Permission and Certificate Selection narrow this permission (User Types). TR7 rejects a change the user makes on vServices the user is not assigned to or on objects that are also used in other vServices.
Where it is openedSettings → User Management → Device Users → Add
Requirement Full permission in the Users area on the account that adds the user, which among the built-in roles exists only in Admin; the vServices to be assigned must have been created beforehand.
vService type HTTP · L7 TCP · Network

Step-by-Step Configuration

Adım 1 Open the Device Users screen

Configuration Menu → Settings → User Management → Device Users is opened.

Adım 2 Click the Add button

The Add button is clicked; the user add form opens (How to add).

Adım 3 Select the role

In the User Type field, Traffic User is selected; if the user will also manage the WAF settings, Traffic+WAF User is selected.

Adım 4 Enter the credentials

The Username, Authorization Source and, for the Local source, the password fields are filled in.

Adım 5 Assign the vServices

The vServices the user will manage are marked in the User vServices field; for Traffic user, at least one vService is selected.

Adım 6 Set the scope switches

Backend Service Permission is turned on only if the user needs to add and edit the Backend Services of their own vServices, and Certificate Selection only if the user needs to select certificates in their vServices; both are off by default (The Authorization and Access Model).

Adım 7 Save

The Add button at the bottom of the form is clicked.

Verification

1LoginTR7 side

A login is made with the new user, and the Load Balancer vService List and the edit form of an assigned vService are opened.

Expected

Only the assigned vServices are listed; if Backend service permission is off, adding and editing in the Backend Service table in the form are disabled

2Shared objectTR7 side

An attempt is made with the same user to edit and save a profile that is also used in other vServices.

ExpectedObject (…) is used in N other vServices. You cannot do any action on it

Common Mistakes

Looking for an IP- or network-based restriction for the user. The user restriction is at the vService level; there is no user restriction based on frontend IP or backend network.
Expecting Traffic user to open a new vService. vServices are created by Admin, Traffic manager or Traffic+WAF manager and assigned to the user.
Taking the locked Backend Service table for an error while Backend service permission is off. While this switch is off, Backend Services are not added or edited in the vService form.
Confusing a traffic access restriction with a user permission. For a traffic restriction by client IPs: Can I block specific IPs/CIDRs or allow only them?

How it is done in the documentation

How do I make sure a user edits only the vServices assigned to them and does not touch Backend Services and certificates? ​

Problem: Team Users Can Change Other People's Services ​

Solution ​

Traffic User and Scope Switches ​

Step-by-Step Configuration ​

Verification ​

Common Mistakes ​