Include/Exclude option in "Set API host access to resources" page

gani

Hi Rui ( @Plural ),

I am glad to let you know that in the new release 5.3.0, that we released today, is support for a plugin with the function that we discussed in this thread here. This plugin is named API host job access.

Documentation for that you can find here:

https://bacularis.app/doc/plugins/action/action-api-host-job-access-plugin.html

and here is this plugin to download in a new Bacularis Add-ons service:

https://addons.bacularis.app/add-on/14/api-host-job-access/

Best regards,
Marcin Haba (gani)

Plural

HI Marcin,

Great news. I'm looking forward to test and use that feature.
Many thanks,

Best regards,
Rui

Plural

Hi Marcin,

Where can we confirm that the jobs are added to the API Host. The job is not listed in the Console ACLs. Do we need to run the job at leat one time?

Best regards,
Rui

gani

Hi Rui,

Now, when I am reading my previous message, I am seeing that my explanation about the plugin was not clear. I am sorry for that.

This API host job access plugin is an action plugin. Action plugins do not work after configuration but they need to be attached to an event/action in Bacularis. To attach this action you need this additional plugin:

https://addons.bacularis.app/add-on/16/job-action/

This plugin is pre-installed and it should be available in Bacularis 5.3.0. When you will configure the Job action plugin, you need to:

select the action type (event). In this case it will be post-create job action.
select the API host job action plugin settings. This way you link the post-create action with the API host job action plugin settings. After that, for each newly created job this API host job action plugin will be executed.

More details about this behaviour you can see here:

https://bacularis.app/doc/plugins/basic.html#bacularis-action-plugins

and here:

https://bacularis.app/doc/plugins/basic.html#bacularis-run-action-plugins

The documentation for this Job action plugin you can find here:

https://bacularis.app/doc/plugins/run-action/job-action-plugin.html

Please let us know how the configuration went on your side.

Good luck.

Best regards,
Marcin Haba (gani)

PS. For the question about need to run the job, this job does not has to be running. To run action on job start there is another event named pre-run-manually or post-run-manually, but in this case it is not needed if wan to add job to ACLs on the job creation.

Plural

HI Marcin,

I'm perfectly aware that this is a plugin an need to be implemented through an action plug in.
Follows my implementation:

The job (not the Job Action) as be created with Patterns/Configs.

EDIT: I tried this simplest regex with the same result.

Best regards,
Rui

gani

Hi Rui,

Thanks for your tests and explanations.

You found a fresh bug. This is bug in 5.3.0 in running actions after applying config/pattern.

Fortunatelly this has been fixed. Great that you found it. Thanks.

If you want to try the fix, this is here:

https://github.com/bacularis/bacularis-web/commit/02ea15a54bb0fa03423313832ee07840487e5268

If you prefer to wait on next release, this is fine as well. I think, we will wait few days on more feedback from the Community about 5.3.0 and after we do new minor release 5.3.1 with fixes.

Best regards,
Marcin Haba (gani)

Plural

HI Marcin,

When I was run the test with the simplest regex expression I do not use the Patterns/Configs and the problem still happens anyway. No JobAcl directive for the new Job in the Console resource.

I will test the Configs/Patterns but I thing the problem it's not there.

Best regards,
Rui

gani

Hi Rui,

OK, thanks for this info. Hmm, it is interesting problem. It looks that there can be something more.

I will do few more tests, this time with fresh 5.3.0, because so far I tried on my dev working copy where it worked with creating jobs (by pattern and by create job button). We will see. I will let know.

Best regards,
Marcin Haba (gani)

gani

Hi Rui,

On my side this plugin on patched 5.3.0 is working fine (pattern and create button as well).

I will wait on your test results.

Best regards,
Marcin Haba (gani)

Plural

Hi Marcin,

I spot the issue. When we change the API host in "Director resource permissions" to "No access" the Job it's not added to the Console. I figure out that the "Console" and "Job" permission must have read-write to write the JobAcl. Do you see any possible security problem with this?
When we delete the Job the JobAcl it's not delete from the bacula-dir.conf file. We need to go to the Console ACL page and press the Save button to apply the changes to the file.

Sorry for the delay replaying, yesterday was hollyday here im Portugal.

Best regards,
Rui

gani

Hi Rui,

Plural I spot the issue. When we change the API host in "Director resource permissions" to "No access" the Job it's not added to the Console. I figure out that the "Console" and "Job" permission must have read-write to write the JobAcl. Do you see any possible security problem with this?

Super that you found it.

For the security problem with this, as long as you do not share to this restricted user any page with the Job or Console configuration form, this will be fine. If the restricted user will get access to a page with Job or Console, he/she will be able to save it.

If your communication between Web => API is protected by OAuth2 (by default is Basic auth, not OAuth2), then you can not set config OAuth2 scope, and then this user will not be able to work with any configuration. This is called Access to functions and you can find it here:

https://bacularis.app/doc/users/function-access.html

Plural When we delete the Job the JobAcl it's not delete from the bacula-dir.conf file. We need to go to the Console ACL page and press the Save button to apply the changes to the file.

Yes, this is true. I agree it might be good to have this function.

BTW: The JobAcl and rest *Acl directive approach for storing resource names is very relaxed becuse we can put in these directives any string (ex. non-existing resource name) and Bacula will not report any error. I mean that Bacula treat these values more like strings that the resource name references.

I noted this problem to solve. Thanks for pointing it.

Best regards
Marcin Haba (gani)

gani

Hi Rui,

gani If your communication between Web => API is protected by OAuth2 (by default is Basic auth, not OAuth2), then you can not set config OAuth2 scope, and then this user will not be able to work with any configuration.

One additional note. Disabling config scope in OAuth2 will cause that this API host job access plugin will not work because in this case the configuration resources are not available for API host. So, it is not a solution for described situation.

Best regards,
Marcin Haba

PS. No problem. In Poland on Thursday we had the same holiday 🙂

« Previous Page