Skip to content

Commit acc18e9

Browse files
kcvemulakcvemula
committed
Merge branch 'master' into feature/sample-api-policy-python
2 parents fbfe881 + 1be6e2b commit acc18e9

File tree

7 files changed

+329
-14
lines changed

7 files changed

+329
-14
lines changed

‎README.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,3 +39,17 @@ Pre-requisites:
3939
- NetBackup 8.1.1 or higher
4040
- See script README for perl requirements and usage
4141

42+
#### Executing the snippets using curl
43+
Pre-requisites:
44+
- NetBackup 8.1.1 or higher
45+
- curl 7.51.0 or higher
46+
- jq command-line parser (https://github.com/stedolan/jq/releases)
47+
48+
Use the following commands to run the curl samples.
49+
- `./get_nb_jobs.sh -master <master_server> -username <username> -password <password>`
50+
- `./get_nb_images.sh -master <master_server> -username <username> -password <password>`
51+
52+
#### Tools
53+
The `tools` folder contains utilities that have proven useful in the development of projects using
54+
NetBackup REST APIs, but do not provide any API usage examples. Again, these tools are not for
55+
production use, but they may be of some use in your work.

‎snippets/curl/get_nb_images.sh‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
!/bin/sh
2+
3+
#####################n#####################################################
4+
5+
# This script demonstrates the usage of netbackup REST API for listing
6+
# the backup images
7+
8+
# This script requires jq command-line JSON parser
9+
# if your system does not have jq installed, this will not work
10+
# jq can be downloaded from here: https://github.com/stedolan/jq/releases
11+
12+
###########################################################################
13+
14+
port=1556
15+
master_server=""
16+
username=""
17+
password=""
18+
domainname=""
19+
domaintype=""
20+
21+
showHelp()
22+
{
23+
echo ""
24+
echo "Invalid command parameters"
25+
echo "Usage:"
26+
echo "./get_nb_images.sh -master <master_server> -username <username> -password <password> -domainname <dname> -domaintype <unixpwd/nt>"
27+
echo ""
28+
exit 1
29+
}
30+
31+
parseArguments()
32+
{
33+
if [ $# -lt 6 ]; then
34+
showHelp
35+
fi
36+
37+
while [ "$1" != "" ]; do
38+
case $1 in
39+
-master)
40+
master_server=$2
41+
;;
42+
-username)
43+
username=$2
44+
;;
45+
-password)
46+
password=$2
47+
;;
48+
-domainname)
49+
domainname=$2
50+
;;
51+
-domaintype)
52+
domaintype=$2
53+
;;
54+
*)
55+
showHelp
56+
;;
57+
esac
58+
shift 2
59+
done
60+
61+
if [ -z "$master_server" ] || [ -z "$username" ] || [ -z "$password" ] || [ -z "$domainname" ] || [ -z "$domaintype" ]; then
62+
showhelp
63+
fi
64+
65+
if [ "${domaintype^^}" = "WINDOWS" ] || [ "${domaintype^^}" = "NT" ]; then
66+
domaintype="nt"
67+
fi
68+
}
69+
70+
###############main############
71+
72+
parseArguments "$@"
73+
74+
basepath="https://$master_server:$port/netbackup"
75+
content_header='content-type:application/json'
76+
77+
##############login#############
78+
79+
uri="$basepath/login"
80+
81+
data=$(jq --arg name $username --arg pass $password --arg dname $domainname --arg dtype $domaintype \
82+
--null-input '{userName: $name, password: $pass, domainName: $dname, domainType: $dtype}')
83+
84+
jwt=$(curl -k -X POST $uri -H $content_header -d "$data" | jq --raw-output '.token')
85+
86+
param1="filter=policyType eq 'Standard'"
87+
param2="page[limit]=10"
88+
89+
##############jobs##############
90+
91+
auth_header="authorization:$jwt"
92+
uri="$basepath/catalog/images"
93+
94+
curl --insecure --request GET --globoff --get $uri -H $content_header -H $auth_header \
95+
--data-urlencode "$param1" \
96+
--data-urlencode "$param2" \
97+
| \
98+
jq '[.data[]|{IMAGE_ID: .id, POLICY: .attributes.policyName, CLIENT: .attributes.clientName, BACKUP_TIME: .attributes.backupTime}]'
99+
100+
exit 0
101+

‎snippets/curl/get_nb_jobs.sh‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
!/bin/sh
2+
3+
4+
#####################n#####################################################
5+
6+
# This script demonstrates the usage of netbackup REST API for listing the jobs
7+
8+
# This script requires jq command-line JSON parser
9+
# if your system does not have jq installed, this will not work
10+
# jq can be downloaded from here: https://github.com/stedolan/jq/releases
11+
12+
###########################################################################
13+
14+
port=1556
15+
master_server=""
16+
username=""
17+
password=""
18+
domainname=""
19+
domaintype=""
20+
21+
showHelp()
22+
{
23+
echo ""
24+
echo "Invalid command parameters"
25+
echo "Usage:"
26+
echo "./get_nb_jobs.sh -master <master_server> -username <username> -password <password> -domainname <dname> -domaintype <unixpwd/nt>"
27+
echo ""
28+
exit 1
29+
}
30+
31+
parseArguments()
32+
{
33+
if [ $# -lt 10 ]; then
34+
showHelp
35+
fi
36+
37+
while [ "$1" != "" ]; do
38+
case $1 in
39+
-master)
40+
master_server=$2
41+
;;
42+
-username)
43+
username=$2
44+
;;
45+
-password)
46+
password=$2
47+
;;
48+
-domainname)
49+
domainname=$2
50+
;;
51+
-domaintype)
52+
domaintype=$2
53+
;;
54+
*)
55+
showHelp
56+
;;
57+
esac
58+
shift 2
59+
done
60+
61+
if [ -z "$master_server" ] || [ -z "$username" ] || [ -z "$password" ] || [ -z "$domainname" ] || [ -z "$domaintype" ]; then
62+
showhelp
63+
fi
64+
65+
if [ "${domaintype^^}" = "WINDOWS" ] || [ "${domaintype^^}" = "NT" ]; then
66+
domaintype="nt"
67+
fi
68+
}
69+
70+
###############main#############
71+
72+
parseArguments "$@"
73+
74+
basepath="https://$master_server:$port/netbackup"
75+
content_header='content-type:application/json'
76+
77+
##############login#############
78+
79+
uri="$basepath/login"
80+
81+
data=$(jq --arg name $username --arg pass $password --arg dname $domainname --arg dtype $domaintype \
82+
--null-input '{userName: $name, password: $pass, domainName: $dname, domainType: $dtype}')
83+
84+
jwt=$(curl -k -X POST $uri -H $content_header -d "$data" | jq --raw-output '.token')
85+
86+
param1="filter=jobType eq 'BACKUP'"
87+
param2="page[limit]=10"
88+
89+
##############jobs##############
90+
91+
auth_header="authorization:$jwt"
92+
uri="$basepath/admin/jobs"
93+
94+
curl --insecure --request GET --globoff --get $uri -H $content_header -H $auth_header \
95+
--data-urlencode "$param1" \
96+
--data-urlencode "$param2" \
97+
| \
98+
jq '[.data[]|{JOBID: .id, TYPE: .attributes.jobType, STATE: .attributes.state, STATUS: .attributes.status}]'
99+
exit 0
100+

‎snippets/perl/README_makeEAadmin.txt‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ What is This?
1818
This script is provided as a demonstration of how to create a non-root admin account to be used for the
1919
purpose of invoking the NetBackup REST APIs.
2020

21-
This deomonstration is written as a perl script and uses the perl module “UserAgent” to invoke https
21+
This demonstration is written as a perl script and uses the perl module “UserAgent” to invoke https
2222
requests to the NetBackup REST APIs.
2323

2424

@@ -31,7 +31,7 @@ PERl modules required
3131
++ JSON
3232
++ HTTP
3333

34-
This utility is written in perl, and is meant to be run directly on the NetBackup master server. The caller of this utility must have sufficient priveleges to execute a NetBackup command line on the Master. Although
34+
This utility is written in perl, and is meant to be run directly on the NetBackup master server. The caller of this utility must have sufficient privileges to execute a NetBackup command line on the Master. Although
3535
it has been developed and tested on RedHat Linux, it should be compatible with any non-windows NetBackup
3636
master server.
3737

@@ -46,7 +46,7 @@ Overview:
4646
This script provides an example of how to login to the NetBackup Rest APIs and get a "token" to be used in
4747
subsequent REST API calls. In this demonstration, the utility creates a new "fictional user" in NetBackup
4848
using the mechanisms described by the "Enhanced Auditing" mechanism in NetBackup. At the time of this writing,
49-
NetBackup 8.1.1 will accept root, local/administrator and any Enhanced Auditing user as a fully-priveleged
49+
NetBackup 8.1.1 will accept root, local/administrator and any Enhanced Auditing user as a fully-privileged
5050
REST API user.
5151

5252
Once an administrator is created, the script demonstrates how to "login" to the REST API services and get
@@ -57,13 +57,13 @@ Outline:
5757
---------------------------------------------------
5858
Setup: First a fictional user is added to "vx domain" using standard NetBackup command lines (bpnbat) for
5959
the purposes of testing. Next, this new fictional user is added to the list of non-root administrators
60-
in the Enhanced Auditing configuration, making this account pseudo root priveleged for the purposes of
60+
in the Enhanced Auditing configuration, making this account pseudo root privileged for the purposes of
6161
NetBackup administration.
6262

63-
APIs: The new administrator user is logged into the REST APIs and recieves a session token. This token is
63+
APIs: The new administrator user is logged into the REST APIs and receives a session token. This token is
6464
captured and included in each subsequent API call as the contents of the standard http "Authorization"
6565
header. The Front End Data report is run as an example of this. Finally the user is logged out of
66-
NetBackup REST which ends the session associated with that toekn.
66+
NetBackup REST which ends the session associated with that token.
6767

6868
Cleanup: Remove our fictional user from the Enhanced Auditing users list and remove the user account
6969
from the vx domain.

‎snippets/perl/makeEAadmin.pl‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -32,12 +32,6 @@
3232
print "Granting VxSS user administrator privileges...\n\n";
3333
system q["/usr/openv/netbackup/bin/admincmd/bpnbaz" -AddUser vx:vx:testuser];
3434

35-
print "Add the new user to the EA user list...\n\n";
36-
my $auth_file = '/usr/openv/java/auth.conf';
37-
open(my $fh, '>>', $auth_file) or die "Could not open auth.conf";
38-
say $fh "testuser ADMIN=All JBP=ALL";
39-
close $fh;
40-
4135
print "Restarting services...";
4236
system q["/usr/openv/netbackup/bin/bp.kill_all"];
4337
system q["/usr/openv/netbackup/bin/bp.start_all"];
@@ -85,7 +79,7 @@
8579
print "**************************************************************";
8680
print "\n\n Making Get Request to Catalog/FrontendData with token \n\n";
8781
if ($response->is_success) {
88-
print "/Catalog/frontenddata request was succesful \n\n";
82+
print "/Catalog/frontenddata request was successful \n\n";
8983

9084
$data = decode_json($response->content);
9185
my $pretty = JSON->new->pretty->encode($data);
@@ -109,7 +103,7 @@
109103
print "**************************************************************";
110104
print "\n\n Making Get Request to list all jobs \n\n";
111105
if ($response->is_success) {
112-
print "List jobs request was succesful \n\n";
106+
print "List jobs request was successful \n\n";
113107

114108
$data = decode_json($response->content);
115109
my $pretty = JSON->new->pretty->encode($data);

‎tools/perl/README_tokendump.txt‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
Examine permissions of the current login token
2+
3+
Compatibility
4+
———————————————————————————————————————————————————
5+
NetBackup 8.1.1 Linux/Unix master server
6+
7+
8+
Who is this for?
9+
---------------------------------------------------
10+
NetBackup Administrators
11+
IT Operations Teams
12+
13+
14+
What is This?
15+
---------------------------------------------------
16+
The NetBackup REST API will authenticate any valid user account provided to the login API. Not every user
17+
has permissions to do anything in NetBackup, however, and this script simply dumps the payload of the
18+
token returned by NetBackup. The token is a JSON Web Token (jwt - see RFC7519) and the "payload" here
19+
refers to the payload section of the jwt. The payload contains some standard JWT "claims" as well as some
20+
NetBackup-specific claims. Of particular interest is the contents of the claim "authz_context" which
21+
represents the permissions "granted" to this user.
22+
23+
Setup:
24+
---------------------------------------------------
25+
Perl 5.20.2 or later
26+
27+
PERl modules required
28+
++ JSON
29+
++ Compress::Zlib
30+
++ MIME::Base64
31+
32+
This utility is written in perl and it has been developed and tested on RedHat Linux.
33+
34+
35+
Overview:
36+
---------------------------------------------------
37+
Occasionally users have been stumped by the fact that the NetBackup REST login API successfully authenticates
38+
a user, but the resulting token results in http 401 Not Authorized responses to any of the other REST apis.
39+
40+
The cause is nearly always that the user is not a known NetBackup administrator. Valid known NetBackup
41+
administrators are "root" on unix, "administrator" on windows, or any user account configured for Enhanced
42+
Auditing. For non-root users Enhanced Auditing is generally the answer and a helper script makeEAadmin.pl is
43+
also provided.
44+
45+
46+
Outline:
47+
---------------------------------------------------
48+
A successful call to https://<yourmaster>:1556/netbackup/gateway/login will return a JSON Web Token in its
49+
response body. Use that token as a (string) argument to this script and the claims are displayed as a JSON
50+
document. In NetBackup 8.1.1, permission is generally all-or-nothing. Look for the specific API permissions
51+
in the "authz_context" claim such as
52+
"LIST_JOBS" : [
53+
"*"
54+
],
55+
This tells you that this token is issued with a grant to list jobs, and permission is on ALL jobs - ["*"].
56+
57+
In addition you may see a claim
58+
"is_admin" : "true",
59+
this indicates that your jwt is issued with the intent of granting all access a NetBackup administrator would
60+
have in previous versions of NetBackup.
61+
62+
If the claims you see do not provide the permission you expected, your user account is not an administrator
63+
known to NetBackup.

0 commit comments

Comments
 (0)