PB with getting hosts depending on permission via REST API

General
1

CMK version: 2.4.0p18 cee
OS version: RHEL 9.7

Hi,

I’m using REST API for listing all hosts I need to see (depending on CG applied on hosts) with a specific user (role : Normal monitoring user). My hosts are located in a subfolder without any permissions on it. The Contact group permission is only applied on hosts I need to see.

With CheckMK 2.3.0p30, I was able to get all hosts with my Contact group (endpoint /domain-types/host_config/collections/all).

My CheckMK site as been updated in 2.4.0p18 version of CheckMK. Since, same request returns nothing. However, if a host is located in “/”, the request returns it.

How can I do to list hosts (located in subfolders) I need to see with the API?

No problem with GUI, I see only my hosts.

Thanks

2

Can you share the exact API calls used? That would make reproducing way easier.

3

Thank you for your interest.
Here is the situation :

Srv1 in folder Main
Srv2 in a folder /test
Both of the servers with permission CG_1

user_1 with role Normal monitoring user and Contact Group CG_1

When using API call with user_1 credential, only Srv1 is returned.

With CMK2.3, Srv1 and Srv2 are returned.

API Call:

request = urllib.request.Request(
f"{apiurl}/domain-types/host_config/collections/all",
method=“GET”,
headers=apiheaders,
)
response = urllib.request.urlopen(request)
results=json.loads(response.read())
results[‘value’]

4

I think I know what is happening. It looks like a security and permission fix introduced in 2.4.

  • In 2.3 there was a known bug where host-level Contact Group permissions could sometimes bypass folder-level restrictions in the Setup part, allowing a user to see host configurations in folders they technically had no read access to.
  • In 2.4 Permission enforcement was tightened. The Setup API now strictly respects folder-level permissions. Because user_1 has no explicit permissions on the /test folder, the API hides the folder and all of its contents from the configuration view.

So in short: You want to use f"{apiurl}/domain-types/host/collections/all" instead of f"{apiurl}/domain-types/host_config/collections/all".

Relevant Werk: Werk #13982: Reading host_config's will now honour contact groups