How can I allow read-only user to ssh into ACI Leafs and spine?

[sarabsin]

Hi Experts,

I have 2 questions:

1. How can i allow user with read-all role and read-only privilege access Leafs and Spine OOB with SSH?Currently when the user does SSH , the user gets prompted to put password but it fails.Do you know if this should be working ?
2. also read-all and read-only user can ssh to APIC and even configure or make changes in APIC. How  is this possible? Is there any other role i can assign so the user cannot make changes to APIC?    

[Andre Leyton]

for number 1. I found adding the role admin with readPriv allowed the read-only user to login via SSH

[Sri Harsha Dasari]

While creating Cisco AV-pair on the authentication server, please use below.

cisco-av-pair=shell:domains=all/read-all/admin

Only admin role could SSH into leaf and spine, So we need to have admin under read-only

Here is how ACI reads the av-pairs

cisco-av-pair=shell:domains=*/#/$

* -- Define Domains

# -- Define Write privilege roles

$ -- Define read privilege roles

You can define multiple roles or domain separated by | 

shell:domains=all/aaa|admin/aaa|admin

OR

Cisco-avpair = "shell:domains = solar/admin/,common//read-all"