Change Folder of a Host via API

Troubleshooting
1

CMK version:2.2.0p11

Hi!

I’m trying to move a host to an other folder via API. (Python script for automation)

My Problem
When I wanna move the host to an other SUBFOLDER! I get the following Error:

{“title”: “Permission denied”, “status”: 403, “detail”: “You lack the permissions to move host HOSTNAME to ~FOLDER~SUBFOLDER.”}

My Code
response = requests.post(
“{}/objects/host_config/HOSTNAME/actions/move/invoke”.format(CheckMKurl),
headers=header,
json = {“target_folder”: “~FOLDER~SUBFOLDER”}

I’m able to move the host to a normal folder but not a SUBfolder…

Any ideas or is it a BUG ?
The user have full permission!

Thanks in advance!
Tobi

2

what is the actual request … i can try and repeat it on my env ?

btw: i use Postman to do my request on the API for testing.

  • Glowsome
3

Hi Glowsome

How I added in my post - there is a POST request.

I don’t think that your able to use it without edit it for your env.

4

I managed to move a host from a (top-) folder (webservers) to a subfolder of it (testsubfolder) with postman.
The action was done with the ‘automation’ -user.

Took me some time to figure it out, but i got it done.

So what i used was a POST request:

https://{{HOST_NAME}}/{{SITE_NAME}}/{{API_URL}}/objects/host_config/test01.mydomain.tld/actions/move/invoke

Headers sent :

image
image717×479 33.6 KB

With payload(body):

{
    "target_folder": "~webservers/testsubfolder"
}

The result was a 200:OK
And the move was reflected when i look up the folder
Now i will need to replay this on my 2.2.0p12 testenv, as this initial attempt was done on a 2.1.0p35 env.

Looking back at your original post, can you try and replace your target_folder value from “~FOLDER~SUBFOLDER” to “~FOLDER\SUBFOLDER” ?

In fiddling around i also used “~FOLDER~SUBFOLDER” as target, but then it was complaining it could not find the target ?

Strangest thing was that when i re-did it after an initial successful move (i discarded the changes, so the hosts was not moved) and tested the “~FOLDER~SUBFOLDER” convention it did work.

  • Glowsome
1 Like
5

I have tried to run the same on a 2.2.0p12 CRE installation, in the same way as i did above on my 2.1.0p35 site.

The result is basically the same error as @Tobi-ADS is getting using the “~FOLDER~SUBFOLDER” -convention.

{
    "title": "Permission denied",
    "status": 403,
    "detail": "You lack the permissions to move host cmk-test.mydomain.tld to ~mainfolder~subfolder."
}

Same 403 error happens when i tried the “~FOLDER/SUBFOLDER” -convention i now get:

So behavior has changed as to 2.1.0pX → 2.2.0pX…

If i pull up the folder information via the API i get the following result:

"domainType": "folder_config",
            "id": "~mainfolder~subfolder",
            "title": "SubFolder",
            "members": {},
            "extensions": {
                "path": "/mainfolder/subfolder",
                "attributes": {
                    "meta_data": {
                        "created_at": "2023-10-25T23:38:13.518988+00:00",
                        "updated_at": "2023-10-25T23:38:13.520776+00:00",
                        "created_by": "MHonkoop"
                    }

If i compare this to the output of my 2.1.0p35 host i dont see any difference to the (test-)subfolder.

I have checked if the API docs have changed ( since i went from going OK on a 2.1.0pX version onto a 2.2.0pX), but i could not see any changes.

Maybe one at CMK can give us insight as to what might have been changed/reworked from 2.1.0pX → 2.2.0pX ?
@Sara , @martin.hirschvogel ?

Additional, i have tried moving the host ( was op top/root level) to move it down just to ‘MainFolder’ (works) and then move it again from there to “Subfolder”, the result was the same 403 error on last step as attempting a direct move into the SubFolder.

  • Glowsome
6

I can confirm I continue to get the same error (see below) when attempting to move a host using the automation account with the administrator role (or any other account), with or without the default contact group of Everything applied to the user.

I have tried the following formats:

  • "target_folder": "/company/sitetype/site"
  • "target_folder": "~company/sitetype/site"
  • "target_folder": "~company~sitetype~site"

Request:

curl 
--request POST
--header Authorization: Bearer automation xxx 
--header Accept: application/json 
--header If-Match: * 
--header Content-Type: application/json 
--data {
"target_folder": "/company/sitetype/site"
} https://checkmk/site/check_mk/api/1.0/objects/host_config/hostname/actions/move/invoke

Error:
{“title”: “Permission denied”, “status”: 403, “detail”: “The user doesn’t belong to the required contact groups of the following objects to perform this action: Folder(‘xxx’, ‘xxx’), Folder(‘company/sitetype/site’, ‘site’), Host('hostname’)”}

My original thread: Using REST API to move a host to a different folder results in Permission denied - Troubleshooting - Checkmk Community

7

Hi @tcwork,

Compared to the error-message i am getting yours seems to have a lot more detail.

In your case it explicitly ‘complains’ about the contact-groups, whereas mine (and @Tobi-ADS) just gives a generic 403 - permission denied.

The case i tested on the 2.1.0p35 box was with an automation-user with not being part of any contact-groups, and to a newly created (sub-)folder.

Under the same conditions i retested it no a 2.2.0p12 box.

As to your post i did one modification on the automation-user, adding it to the ‘everything’-group.

image
image1567×442 15.6 KB

But when retesting i could not get CMK produce a similar detailed message.

One thing it did trigger, it made may notifications go awol , as the automation-user had no email, so any/all notification produced a fail :frowning: - so i reverted the contact-group assignment on my end.

So i would like/need some more detail as to reproduce/verify the difference in your error-output.

  • Glowsome
8

@Glowsome looking through the Werks I noticed this change in 2.2.0p10 (I’m on p9 as that’s all that was available at the time for my trial of CCE) though it says for CRE, not sure if that means they only fixed it in CRE or for CRE and “up”.

I’ll be installing the latest CEE tomorrow and will check if the issue is resolved for me. If not, from there I’ll contact support as we’ve now paid for Checkmk and opted for Pro support…

9

In this case, it means for all editions. I think the only CRE fix would be a core related bugfix.

1 Like
10

So, updated to CEE 2.2.0p12 and I now get the same error message as you both @Glowsome @Tobi-ADS

{“title”: “Permission denied”, “status”: 403, “detail”: “You lack the permissions to move host hostname to ~comapny~sitetype~site.”}

I’ll be opening a ticket for this.

1 Like
11

Hi @tcwork

Would love to hear back from you with the outcome of the ticket.

  • Glowsome
12

A dev is currently working on fixing this. @bkuhn was a bit quicker reporting this (and analyzing the root cause for us, thanks!) :slight_smile:

13

My pleasure, thanks to the Syncer I had this Problem in multiple consumer Installations suddenly, and therefore I’m interested in a quick fix, so happy to help :slight_smile:

14

Is there any update on this @tcwork @bkuhn @martin.hirschvogel ?

15

Hey,
yes, this is fixed now: host_config: can now move host between nested folders
Comes with 2.2.0p15

2 Likes
16

Which is not yet available for download on the Download page.

17

Sorry, should have been more specific.
Will come with 2.2.0p15, which is planned for next week (if everything goes according to plan)

1 Like
18

What’s going on with the p15? I have now 9 Consumer Installations (I know of) standing still regarding Host Changes, because of this bug.

19

Internal tests revealed a newly introduced bug in p15, which had to be fixed first. The bug has been removed and our second release candidate for p15 will go into testing today or Monday.

20

@bkuhn It was released yesterday