This article helps to resolve NETCONF SSH authorization failures encountered when a user is granted configuration access through allow-configuration-regexps and can successfully perform the same configuration changes through the Junos CLI but not through NETCONF

A user is configured with restricted configuration privileges using allow-configuration-regexps.

{master:0}

user@switch#set system login class user-name permissions configure

{master:0}

user@switch#set system login class user-name allow-configuration-regexps "protocols dot1x authenticator interface ge-.*"

• The user can successfully modify the configuration from CLI configuration mode:

{master:0}

user@switch# set protocols dot1x authenticator interface ge-0/0/8.0 disable

{master:0}

user@hostname# commit

However, performing the equivalent configuration change through a NETCONF SSH session fails with an authorization error as below:

<rpc-error>

 <error-type>protocol</error-type>

 <error-tag>operation-failed</error-tag>

 <error-severity>error</error-severity>

 <error-message>permission denied for protocols</error-message>

 <error-info>

  <bad-element>disable</bad-element>

 </error-info>

</rpc-error>

When configuration access is controlled using allow-configuration-regexps, the authorization behavior for NETCONF XML payloads can differ from the behavior observed in the CLI.

• To allow the following configuration statements to work as expected through a NETCONF SSH session for user, configure broader regular expressions that permit access to the required hierarchy:

set system login class user-name allow-configuration-regexps "interfaces.*"

set system login class user-name allow-configuration-regexps "protocols dot1x.*"

set system login class user-name allow-configuration-regexps "protocols dot1x authenticator interface.*"

set system login class user-name allow-configuration-regexps "protocols dot1x authenticator interface ge-.*"

After committing the updated login class configuration, retry the NETCONF operation. If still the issue persisted kindly open a ticket with JTAC for further assistance.

https://www.juniper.net/documentation/en_US/junos12.2/topics/example/access-privileges-configuration-mode-commands-regexps-configuring.html