Local authentication and role-based access control (RBAC)

Overview

F5 Insight local users are human accounts managed for access to the F5 Insight UI and API. Administrators can create and manage users, assign roles, and reset passwords. Users can change their own passwords.

Local users are separate from external users, who authenticate through a configured identity provider. For API and automation access without a human login, use Machine users.

Note

In a disaster recovery (DR) pair, the standby instance can’t read the local user database. As a result, the standby instance switches to System mode for UI login automatically. When you promote the standby instance to primary, it returns to the configured login mode. For details, see Configure disaster recovery.

If the login page displays the System mode banner, see Switch from System mode to Local mode.

Login modes

The login mode controls which accounts can log in to the UI. F5 Insight supports two UI login modes.

Mode Accounts that log in to the UI Password source
System The single System admin account The system password, which SSH and the serial console also use
Local Local users The F5 Insight database

When System mode is active, the login page displays a banner. To change the mode, use the f5insight-auth-mode utility.

The login mode doesn’t affect external users or machine users. External users log in to the UI through an identity provider. Machine users use the API only. For details, see Machine users.

Switch from System mode to Local mode

Switch to Local mode so that you and other users log in to the UI with local accounts. First, create a local user with the Admin role. Then change the login mode, and log in with the new account.

Before you begin

Verify that you have the following:

  • The System admin password
  • SSH or serial console access to the system as the System admin account

Create a local Admin user

Important

Create a new username for your Admin user. F5 Insight includes a local admin user with a randomized password. The local admin password and the System admin password don’t sync. Two admin accounts with different passwords can cause confusion.

  1. Log in to the UI with the System admin account.

  2. Go to Users Administration > Users.

  3. Select Add User.

  4. Enter a Username, Email, and Display Name.

  5. For Role, select Admin.

    With the Admin role, you can create more local users after you switch modes.

  6. For Password, generate a password or enter an initial password.

  7. Copy the password, and store it in a secure location.

    You need this password for your first login in Local mode.

  8. Save the new user.

Change the login mode

  1. Log in to the system as the System admin account through SSH or the serial console.

  2. Set the login mode to local:

    sudo f5insight-auth-mode set local

  3. When prompted, confirm the change.

    The backend deployment restarts.

  4. Refresh the UI login page until the System mode banner no longer displays.

Log in with the new user

  1. Log in to the UI with the new username and the password that you saved.
  2. When prompted, set a new password.
  3. Log in again with the new password.

To switch back to System mode, run sudo f5insight-auth-mode set system.

Local-user roles

Assign each local user one F5 Insight role:

  • Admin: Full read and write access, including user management.
  • Operator: Day-to-day operational access without user management.
  • Viewer: Read-only access.

The Admin role grants application-level access to F5 Insight UI functions. It doesn’t grant root-level system privileges or access to the command-line interface (CLI), SSH, or serial console. Assign each user the least-privileged role that supports their tasks.

The username admin always receives Admin. You can’t assign Operator or Viewer to that username, including an external account named admin.

Roles set application-level permissions for local, external, and machine users. Each account type can use only its supported interface.

Manage local users

Users with the Admin role can:

  • Create, list, view, update, and delete local users.
  • Assign or change a user’s role.
  • Reset a user’s password.

To create a local user, go to Users Administration > Users, and select Add User.

Users can change their own password with the password-management option in the UI. You might need to change your password after an administrator creates or resets your account.

Note

Reset Password appears for all users, including external users, but password resets apply only to local users. Manage external passwords through the identity provider.

Username collisions

Important

If there’s any risk of username collisions, don’t use local and external users together. Keep local usernames distinct from all external usernames.

When a local and an external username collide, you can no longer manage the local user or reset the local password. For example, after an external admin login, the local admin account disappears from the user list. See Known authentication issues.