---

Subject:	RE: How to add extra permissions to Zen Operator role : skills1st.UserRoles ZenPack advice
Author:	Doug Syer
Posted:	2018-01-12 11:51

check $ZENHOME/Products/ZenModel/ZenossSecurity.py

there are two levels of restrictions in zenoss one on the objects you can see that in decorators in the classes in the $ZENHOME/ZenModel classes and there are also sometimes additional ACL checks in the javascript (and sometimes those arent consistent) ...if you have to change the javascript either with or without a zenpack you need to recompile the javascript..

in the object you will see something like(our permissions are customized via zenpacks and we run core so this may not be exactly what you see in Device.py

security.declareProtected(ZEN_CHANGE_DEVICE_PRODSTATE, 'setProdState')
def setProdState(self, state, maintWindowChange=False, REQUEST=None):

in that case you need the permission ZEN_CHANGE_DEVICE_PRODSTATE associated with the ZEN_OPERATOR role.  i havent looked at Jane ZenPack but somewhere in there in the __init__ more than likely she assigns permissions to roles.  you would need that permission to just give out change prodstate and that would either need to be assigned to a global role or set as a management role at the organizer that you want to give the permisisons on.

sometimes again even if the user has the permission you may find that the javascript has its own idea of what is set so in that case you have to fix the js.

I hate giving out that permission because people permanently put things into MM and then i end up getting calls inevitably about it.  what I do is I have device commands that run scripts that create maintenance windows of hard coded 1-2,8, and 24 hour windows that way nobody forgets to remove their maintenance changes and im not dragged into us missing something because someone forgot to undo their maintenance state..in 4 you can do it with a dmd script in 5 you can do it with jsonapi which is alot faster.  to be able to create windows for multiple devices using a custom command though you need your own custom command widget that can select multiple devices and use that to send it to zenjobs so the users dont sit there for 100 years...or just do it via organizer...

also i set up global roles with zenoperator like permissions then assign people an admin role at the containers that the are responsible for again just a defensive measure so that people dont put the wrong things in MM and thus ending me up on a conference call..


------------------------------
Doug Syer
NWN Corporation
Waltham MA
------------------------------