Assign credentials to a device

Each device has a list of credentials. The order of the list and the Admin setting of each credential decide which credential ITVA uses. In this guide, you learn how ITVA chooses, then assign credentials so that each feature uses the access you intend.

How ITVA chooses a credential

The device's Credentials list goes from highest priority at the top to lowest priority at the bottom. Each credential in the list also has an Admin setting, Yes or No. On the device's page, Permissions shows this as Admin or User.

ITVA uses only that one credential. It does not try the next credential in the list if the first one fails to sign in.

What the AI can do on a device

The AI never uses a credential with Admin set to Yes. If a device has no credential with Admin set to No, the AI cannot run commands on it, and it reports "No non-admin credential assigned."

The AI also has these limits:

• It can run only commands that start with show, get, diagnose, ping, or traceroute.
• It can run commands only on devices that the person using the AI can manage.

Admin is a label that you set in ITVA. ITVA does not check what the account can do on the device. To limit what the AI can do, give the non-admin credential a read-only account on the device.

Before you begin

• Your role must have Manage set to All for Devices, for the device's tags.
• You must be able to see the credentials that you want to assign. If you are not an administrator, each credential must have one of the tags in your permissions, and your role must have View on Credentials. See Use tags.
• A read-only account on the device, saved as a credential. See Create a read-only account on Juniper Junos or Create a read-only account on Cisco IOS-XE.

Assign credentials

We recommend a read-only credential at the top of the list with Admin set to No. Then syncs and the AI both use the read-only account.

1. Open the device, and select Edit.
2. In Credentials, select the add button (+). The Select Credential panel opens.
3. Select the read-only credential.
4. In the Admin column, turn the switch off for that credential. It shows No. ITVA sets new credentials to Yes by default.
5. If the credential is not at the top of the list, use the up arrow to move it to the top.
6. Optional: Add more credentials below it. Set Admin to Yes for accounts with full access.
7. Select Save.

Caution: If an Admin credential is at the top of the list, syncs and other probe actions use that account, even when a read-only credential is lower in the list.

If you import devices from a CSV file, ITVA assigns the credential in api_credential_name with Admin set to Yes. To let the AI use a device that you imported, edit the device and add a credential with Admin set to No.

Check that it worked

1. On the device's page, look at Credentials. The read-only credential is first, and Permissions shows User.
2. Select Test Connection. The result is Successfully connected.
3. Ask the AI to run a show command on the device. It returns the output.

Troubleshooting

• If the AI reports "No non-admin credential assigned.", every credential on the device has Admin set to Yes. Add a read-only credential with Admin set to No.
• If the AI says that a command is not supported, the command does not start with one of the allowed words. Run it yourself, or use a show command instead.
• If a sync shows "The device ... does not have a credential assigned.", the device has no credentials. Add one.
• If a credential is not in the Select Credential panel, you cannot see it. Ask an administrator to add one of your tags to the credential.
• If syncs fail but the second credential in the list is correct, move the correct credential to the top. ITVA does not try the second credential.