Pearl device web interface and REST API access control
Applies to: Pearl-2, Pearl Mini, Pearl Nano, Pearl Nexus.
Access to the Pearl web-based Admin panel and REST API is controlled by a Role Based Access Control (RBAC) model with three roles:
- Administrator: the highest level of system privileges. Responsible for overall configuration and management, including user account management and system settings, and can also perform day-to-day tasks.
- Operator: interacts with the system to perform day-to-day tasks and operations. Access is restricted to operational functions as defined by the administrator.
- Viewer: read-only access. Can monitor system status and view data, but cannot make changes to the system configuration or settings.
Users can be authenticated against the device's internal database or against an external LDAP server.
When HTTPS is enabled, all data transferred between a web browser or third-party application using the Pearl REST API and the Pearl device is encrypted. Pearl devices exclusively use TLS version 1.2; earlier TLS versions are deactivated and cannot be used in negotiations. Supported ciphers:
| Name | Auth | Encryption | Key exchange | MAC |
|---|---|---|---|---|
| ECDHE-RSA-AES128-SHA256 | RSA | AES(128) | ECDH | SHA256 |
| ECDHE-RSA-AES256-SHA384 | RSA | AES(256) | ECDH | SHA384 |
| ECDHE-RSA-AES128-GCM-SHA256 | RSA | AESGCM(128) | ECDH | AEAD |
| ECDHE-RSA-AES256-GCM-SHA384 | RSA | AESGCM(256) | ECDH | AEAD |
| ECDHE-RSA-CHACHA20-POLY1305 | RSA | CHACHA20/POLY1305(256) | ECDH | AEAD |