Add Klish-based AAA CLI commands with OpenConfig to SONiC transformation by huanlev · Pull Request #1 · arthur-cog-sonic/sonic-mgmt-framework

huanlev · 2026-01-30T00:59:39Z

Add Klish-based AAA CLI commands with OpenConfig REST API integration

Summary

This PR implements Klish-based AAA (Authentication, Authorization, and Accounting) CLI commands for SONiC, migrating from Click-based commands in sonic-utilities to the Klish framework. The implementation follows the three-layer architecture: XML command definitions, Python actioners, and Jinja2 templates.

New files:

CLI/clitree/cli-xml/aaa.xml - XML command definitions for all AAA CLI commands
CLI/actioner/sonic_cli_aaa.py - Python actioner making REST API calls to the management backend
CLI/actioner/tests/test_sonic_cli_aaa.py - Unit tests for the actioner (49 tests)
CLI/renderer/templates/show_aaa.j2 - Jinja2 template for show aaa output formatting
docs/AAA_Klish_CLI_HLD.md - High-level design document

Commands implemented:

aaa authentication failthrough/fallback/debug/trace {enable|disable|default}
aaa authentication login <method1> [method2]
aaa authorization login <method1> [method2]
aaa accounting login <method1> [method2]
no aaa authentication/authorization/accounting ... (reset to defaults)
show aaa

Updates since last revision

Added unit tests: Added 49 unit tests in CLI/actioner/tests/test_sonic_cli_aaa.py that verify CLI commands correctly invoke the actioner handlers. Tests cover all handler functions, helper functions, and CLI-to-handler mapping.
Renamed actioner file: Changed from sonic-cli-aaa.py to sonic_cli_aaa.py (underscores instead of hyphens) for clish_pyobj builtin compatibility.

Review & Testing Checklist for Human

Companion PR required: This PR requires sonic-mgmt-common#2 with the Go transformer (xfmr_aaa.go) and YANG annotations (openconfig-system-annot.yang). Verify that PR is merged first.
REST API paths: Verify the REST paths in sonic_cli_aaa.py (e.g., openconfig-system-ext:failthrough) match the actual OpenConfig extensions supported by the backend.
XML schema validation: Validate aaa.xml against the Klish XML schema to ensure command syntax is correct.
End-to-end testing: Test all CLI commands on a SONiC device with the management framework running to verify the full flow works.
Unit tests use mocks: The unit tests mock ApiClient and other dependencies - they verify handler logic but not actual REST API integration.

Recommended test plan:

Deploy both this PR and the sonic-mgmt-common companion PR
Run unit tests: python3 -m pytest CLI/actioner/tests/test_sonic_cli_aaa.py -v
Run show aaa to verify default values display correctly
Configure each AAA setting and verify ConfigDB entries
Test no commands to reset values
Verify error handling for invalid inputs

Notes

Unit tests pass locally (49 tests) but use mocked dependencies
No functional testing was performed on a real SONiC device
The HLD document provides detailed architecture and command mapping information

Link to Devin run: https://cisco-demo.devinenterprise.com/sessions/239c6c349b7349a388ecaffa812b80ce
Requested by: @huanlev

This commit implements Klish-based AAA (Authentication, Authorization, and Accounting) CLI commands for SONiC, migrating from Click-based commands in sonic-utilities to the Klish framework. New files: - CLI/clitree/cli-xml/aaa.xml: XML command definitions for AAA CLI - CLI/actioner/sonic-cli-aaa.py: Python actioner for REST API calls - CLI/renderer/templates/show_aaa.j2: Jinja2 template for show output - docs/AAA_Klish_CLI_HLD.md: High-level design document Commands implemented: - aaa authentication failthrough/fallback/debug/trace enable/disable/default - aaa authentication login <method1> [method2] - aaa authorization login <method1> [method2] - aaa accounting login <method1> [method2] - no aaa authentication/authorization/accounting (reset to defaults) - show aaa Signed-off-by: Devin AI <devin-ai-integration[bot]@users.noreply.github.com> Co-Authored-By: huanle@cisco.com <huanle@cisco.com>

devin-ai-integration · 2026-01-30T00:59:42Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment and CI monitoring

…Klish CLI This commit updates the submodule references to include: - sonic-mgmt-common: AAA transformer and YANG annotations for OpenConfig to SONiC translation - sonic-mgmt-framework: Klish-based AAA CLI commands with OpenConfig to SONiC transformation Related PRs: - sonic-mgmt-common: arthur-cog-sonic/sonic-mgmt-common#2 - sonic-mgmt-framework: arthur-cog-sonic/sonic-mgmt-framework#1 Co-Authored-By: huanle@cisco.com <huanle@cisco.com>

Co-Authored-By: huanle@cisco.com <huanle@cisco.com>

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 5 additional flags.

huanlev · 2026-02-06T01:20:22Z

CLI/clitree/cli-xml/aaa.xml

+    <!-- aaa authentication debug -->
+    <COMMAND name="aaa authentication debug" help="Enable/disable AAA debugging">
+      <PARAM name="option" help="Enable/disable/default debug" ptype="AAA_ENABLE_DISABLE_DEFAULT"> </PARAM>
+      <ACTION builtin="clish_pyobj">sonic_cli_aaa patch_openconfig_aaa_aaa_authentication_debug ${option}</ACTION>


Would reference to sonic_cli_aaa be resolved correctly as the script name is sonic-cli-aaa.py?

Good catch! You're right - the clish_pyobj builtin uses underscores in module names, so the file needed to match.

I've renamed the actioner file from sonic-cli-aaa.py to sonic_cli_aaa.py to ensure it resolves correctly. The XML references sonic_cli_aaa which will now match the file sonic_cli_aaa.py.

…lity The clish_pyobj builtin uses underscores in module names, so the actioner file needs to use underscores instead of hyphens to be resolved correctly. Co-Authored-By: huanle@cisco.com <huanle@cisco.com>

huanlev · 2026-02-06T01:33:38Z

CLI/clitree/cli-xml/aaa.xml

+    <!-- aaa authentication trace -->
+    <COMMAND name="aaa authentication trace" help="Enable/disable AAA packet trace">
+      <PARAM name="option" help="Enable/disable/default trace" ptype="AAA_ENABLE_DISABLE_DEFAULT"> </PARAM>
+      <ACTION builtin="clish_pyobj">sonic_cli_aaa patch_openconfig_aaa_aaa_authentication_trace ${option}</ACTION>


Same as previous comment. Can we add unit-test to verify config aaa authentication trace enable would execute the sonic-cli-aaa.py script?

Done! I've added comprehensive unit tests in CLI/actioner/tests/test_sonic_cli_aaa.py (49 tests) that verify the CLI commands correctly invoke the actioner functions.

Tests added:

TestCliCommandMapping - Verifies that CLI commands like aaa authentication trace enable map to the correct handler function (patch_openconfig_aaa_aaa_authentication_trace)

TestAuthenticationTrace - Tests the trace handler with enable/disable/default/invalid options

TestRunFunction - Tests the run() entry point that dispatches CLI arguments to handlers

Plus tests for all other handlers (failthrough, fallback, debug, login, authorization, accounting)

How to run:

cd sonic-mgmt-framework python3 -m pytest CLI/actioner/tests/test_sonic_cli_aaa.py -v

All 49 tests pass locally.

huanlev

A few comments about the script sonic-cli-aapy.py name, and its execution.

- Add tests directory with 49 unit tests covering all handler functions - Test helper functions: aaa_path, check_ok, option_to_bool, methods_to_list - Test all authentication handlers: failthrough, fallback, debug, trace, login - Test authorization and accounting handlers - Test get_openconfig_aaa_aaa for show command - Test run() entry point function - Test CLI command to handler mapping verification Tests verify that CLI commands like 'aaa authentication trace enable' correctly invoke the sonic_cli_aaa.py script handlers. Co-Authored-By: huanle@cisco.com <huanle@cisco.com>

huanlev mentioned this pull request Jan 30, 2026

Add AAA transformer and YANG annotations for OpenConfig to SONiC translation arthur-cog-sonic/sonic-mgmt-common#2

Open

4 tasks

huanlev mentioned this pull request Jan 30, 2026

Update sonic-mgmt-common and sonic-mgmt-framework submodules for AAA Klish CLI arthur-cog-sonic/sonic-buildimage#18

Open

12 tasks

Trigger Azure pipeline build

96dcc1d

Co-Authored-By: huanle@cisco.com <huanle@cisco.com>

devin-ai-integration bot reviewed Feb 3, 2026

View reviewed changes

huanlev commented Feb 6, 2026

View reviewed changes

Rename sonic-cli-aaa.py to sonic_cli_aaa.py for clish_pyobj compatibi…

72d005e

…lity The clish_pyobj builtin uses underscores in module names, so the actioner file needs to use underscores instead of hyphens to be resolved correctly. Co-Authored-By: huanle@cisco.com <huanle@cisco.com>

huanlev commented Feb 6, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Klish-based AAA CLI commands with OpenConfig to SONiC transformation#1

Add Klish-based AAA CLI commands with OpenConfig to SONiC transformation#1
huanlev wants to merge 4 commits intomasterfrom
devin/1769734716-aaa-klish-cli

huanlev commented Jan 30, 2026 •

edited by devin-ai-integration bot

Loading

Uh oh!

devin-ai-integration bot commented Jan 30, 2026

Uh oh!

devin-ai-integration bot left a comment

Uh oh!

huanlev Feb 6, 2026

Uh oh!

devin-ai-integration bot Feb 6, 2026

Uh oh!

huanlev Feb 6, 2026

Uh oh!

devin-ai-integration bot Feb 6, 2026

Uh oh!

huanlev left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

huanlev commented Jan 30, 2026 • edited by devin-ai-integration bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Add Klish-based AAA CLI commands with OpenConfig REST API integration

Summary

Updates since last revision

Review & Testing Checklist for Human

Notes

Uh oh!

devin-ai-integration bot commented Jan 30, 2026

🤖 Devin AI Engineer

Uh oh!

devin-ai-integration bot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

huanlev Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration bot Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

huanlev Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration bot Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

huanlev left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

huanlev commented Jan 30, 2026 •

edited by devin-ai-integration bot

Loading