Partial admin commit

bin/panxapi.py

@@ -171,6 +171,8 @@ def main():
                 kwargs['extra_qs'] = options['ad_hoc']
             if len(options['vsys']):
                 kwargs['vsys'] = options['vsys'][0]
+            if len(options['admin']):
+                kwargs['admin'] = options['admin'][0]
             xapi.user_id(**kwargs)
             print_status(xapi, action)
             print_response(xapi, options)
@@ -276,6 +278,8 @@ def main():
                 kwargs['extra_qs'] = options['ad_hoc']
             if len(options['vsys']):
                 kwargs['vsys'] = options['vsys'][0]
+            if len(options['admin']):
+                kwargs['admin'] = options['admin'][0]
             xapi.op(**kwargs)
             print_status(xapi, action)
             print_response(xapi, options)
@@ -303,6 +307,8 @@ def main():
                         c.no_vsys()
                     elif part == 'vsys':
                         c.vsys(options['vsys'])
+                    elif part == 'admin':
+                        c.admin(options['admin'])
 
                 if options['serial'] is not None:
                     c.device(options['serial'])
@@ -374,6 +380,7 @@ def parse_opts():
         'partial': [],
         'sync': False,
         'vsys': [],
+        'admin':[],
         'commit_all': False,
         'ad_hoc': None,
         'modify': False,
@@ -428,7 +435,7 @@ def parse_opts():
     short_options = 'de:gksS:U:C:A:o:l:h:P:K:xpjrXHGDt:T:'
     long_options = ['version', 'help',
                     'ad-hoc=', 'modify', 'validate', 'force', 'partial=',
-                    'sync', 'vsys=', 'src=', 'dst=', 'move=', 'rename',
+                    'sync', 'vsys=', 'admin=', 'src=', 'dst=', 'move=', 'rename',
                     'clone', 'override=', 'export=', 'log=', 'recursive',
                     'cafile=', 'capath=', 'ls', 'serial=',
                     'group=', 'merge', 'nlogs=', 'skip=', 'filter=',
@@ -480,6 +487,10 @@ def parse_opts():
             if arg:
                 l = get_vsys(arg)
                 [options['vsys'].append(s) for s in l]
+        elif opt == '--admin':
+            if arg:
+                l = get_admin(arg)
+                [options['admin'].append(s) for s in l]
         elif opt == '-A':
             options['commit_all'] = True
             options['cmd'] = get_element(arg)
@@ -644,6 +655,17 @@ def get_vsys(s):
             else:
                 list.append(v)
     return list
+
+
+def get_admin(s):
+    list = []
+    admin = s.split(',')
+    for admin in admin:
+        if admin:
+
+            list.append(admin)
+
+    return list
 
 
 def get_parts(s):
@@ -880,6 +902,7 @@ def usage():
     --override element    override template object at xpath
     --vsys vsys           VSYS for dynamic update/partial commit/
                           operational command/report
+    --admin admin         admin for specific update/partial commit                        
     -l api_username[:api_password]
     -h hostname
     -P port               URL port number

doc/panxapi.rst

@@ -188,6 +188,7 @@ DESCRIPTION
   - shared-object-excluded
   - no-vsys
   - vsys
+  - admin
 
   **device-and-network-excluded** applies when the device is in
   single-vsys mode and **shared-object-excluded** applies when the device
@@ -197,6 +198,14 @@ DESCRIPTION
   options or separating each part with comma (,).  Virtual systems for
   the **vsys** part can be specified with **--vsys**.
 
+ ``--admin`` *admin*
+  Specify optional **admin** for partial commit (**--partial** admin). Commits 
+  only the changes made only by specified administrator accounts.  Requires
+  PanOS 8.0+.
+
+  Multiple admin users can be specified by using multiple
+  **--admin** options or separating each *admin* with comma (,).
+
  ``--sync``
   Perform a synchronous commit.
 

lib/pan/commit.py

@@ -26,6 +26,7 @@
     'shared-object-excluded',
     'no-vsys',
     'vsys',
+    'admin',
     ])
 
 _part_xml = {
@@ -39,6 +40,8 @@
         '<no-vsys></no-vsys>',
     'vsys':
         '<member>%s</member>',
+    'admin':
+        '<member>%s</member>',
     }
 
 
@@ -59,6 +62,7 @@ def __init__(self,
         self._merge_with_candidate = merge_with_candidate
         self.partial = set()
         self._vsys = set()
+        self._admin = set()
         self._device = None
         self._device_group = None
 
@@ -99,6 +103,16 @@ def vsys(self, vsys):
             vsys = [vsys]
         for name in vsys:
             self._vsys.add(name)
+
+    def admin(self, admin):
+        if not self._commit_all:
+            part = 'admin'
+            self.partial.add(part)
+
+        if type(admin) == type(''):
+            admin = [admin]
+        for name in admin:
+            self._admin.add(name)    
 
     def device(self, serial):
         self._device = serial
@@ -132,6 +146,9 @@ def __commit_all(self):
 
         if self._vsys:
             s += '<vsys>%s</vsys>' % self._vsys.pop()
+
+        if self._admin:
+            s += '<admin>%s</admin>' % self._admin.pop()
 
         s += '</shared-policy></commit-all>'
 
@@ -158,6 +175,14 @@ def __commit(self):
                         xml_vsys = _part_xml[part] % name
                         s += xml_vsys
                     s += '</vsys>'
+
+                elif part == 'admin':
+                    s += '<admin>'
+                    for name in self._admin:
+                        xml_admin = _part_xml[part] % name
+                        s += xml_admin
+                    s += '</admin>'
+
                 else:
                     s += _part_xml[part]
         if self.partial:
@@ -181,8 +206,10 @@ def __commit(self):
 
     c = pan.commit.PanCommit()
     c.force()
+    c.partial
     c.device_and_network_excluded()
     c.policy_and_objects_excluded()
     c.shared_object_excluded()
     c.vsys(['vsys4', 'vsys5'])
+    c.admin(['admin'])
     print('cmd:', c.cmd())