Permission for (Central) Templates

[RobertS]

I have prepared several central templates and i don't want anybody to change them. Then i have some Admins for different servergroups like Windows Admins, Webserver Admins, Fileserver Admins and so on. They are all Zabbix Admins and they have read-write access to their hostgroup. But as they should not change the central templates, they have read-only access for the templates.

Problem: You need rw access for the template to link it to a host. And if you have that you can also change the template Linking (=using) a template does not write anything to the template, so why is write needed?

There is a bug report on this ZBX-3534 but is is closed and won't fix.

Do you have a similar situation and how did you solve this?

Regards,
Robert

[Yello]

Hi,
I give hardly anyone read/write access regardless of their role so I don't have this issue. I wonder consider reorganizing the way you handle permissions and see if that works for you.

How does it work for you if you create template groups and give these users rw access to their specific template domains and ro access to the zabbix hosts and hostgroups? In fact, I think i'll check this out when i get time cos I'm bound to get pressure to give certain users rw access sooner or later.


Regards,
David

[RobertS]

My Admins need to change profile information and add hosts.This is not possible unless you have rw access to the template linked to the host. What has the profile information of the host to do with a template?

Another example: It is possible to change the status of the Host (Monitored, Not monitored) by clicking the status-link on the host list, but it is NOT possible to change the status in the update-form on the host.

I understand the technical reason for this, but not the logical.

[Yello]

My Admins need to change profile information and add hosts.This is not possible unless you have rw access to the template linked to the host. What has the profile information of the host to do with a template?

Another example: It is possible to change the status of the Host (Monitored, Not monitored) by clicking the status-link on the host list, but it is NOT possible to change the status in the update-form on the host.

I understand the technical reason for this, but not the logical.

You seem to be getting annoyed with me. Don't do that otherwise I might get annoyed too.

Investigate using the api to make the types of changes these people need. You might find that some lateral thinking allows you to resolve this issue.

Regards,
David

[RobertS]

Hi David,

my 2nd post was just some more investigations on the case and clarification on what the problem is. Sorry, don't get annoyed, don't take it personal. I always appreciate someone who wants to help others like you.

I am a little bit disappointed that I can't use the permission system and simply don't understand why there is permission needed on a template to change the ip address or serial number of a host. And I wonder if someone else has the same problem.

I will have a look at the code.

Regards,
Robert

[Yello]

Hi,
I think the best solution to yor problem is to implement the functionality required by your admins via script and the api; and then lock down the front-end accounts. I would definitely recommend creating and configuring at least your hosts via the api...

I think I've read somewhere that the permissions system will change in the future and become more granular. Until then you need to work around it where it doesn't meet your needs. What I've suggested might help you in that regard or get you thinking in new directions.


Regards,
David

[RobertS]

Solution found

I found a solution for my problem, which might be "quick and dirty", but it works for me.

The permission error when you click "Save" on "hosts.php" and don't have write-access to a linked template is generated in the "function massAdd" in "class.ctemplate.php". I am no programmer but as I understand the templates are checked here for write-permission (editable) and if not an error is raised. So I simply remarked this line (line 1154 in 1.8.6) :

foreach($templates as $tnum => $template){
 if(!isset($upd_templates[$template['templateid']])){
[COLOR="red"]//[/COLOR]  self::exception(ZBX_API_ERROR_PERMISSIONS, S_NO_PERMISSION);
 }
}

Another option is to remark the editable-check (line 1148 in 1.8.6):

$upd_templates = self::get(array(
 'templateids' => $templateids,
[COLOR="red"]//[/COLOR] 'editable' => 1,
 'preservekeys' => 1
));

WARNING: This may have unwanted side-effects and changes the permission system!!!

I checked the following functionality:
Setup: User with right "Zabbix Admin" and RW access for a hostgroup containing some server-hosts he wants to administer; templates in a separate hostgroup managed centrally by "Super Admins" with RO access on this hostgoup for the user

• User can link templates to the server-host, he can select the templates he has RO access on
• User can "unlink and clear" template, unlink only is denied
• User can edit host details, profile, ext. profile for server-host
• User can add items to the host
• User can see and click on items of the server-host coming from the template and can change the not greyedout parts
• User can not edit the item of the template
• User can not select the template from "Configuration/Templates", so he can not edit it

Modified setup: The template used is moved from the central templates hostgroup (RO) to the hostgroup of server-hosts (RW) to become a template managed by this user. The template has an other linked templates which are still in the central templates hostgroup (RO) and should not be modified.

• User can edit the (his) template
• User can not edit the linked template and its items
• User can add item to his template and modify existing items
• User can link and unlink additional templates from central templates hostgroup

That's exactly what I wanted. If anybody knows what will not work any more after this change - any input is welcome.

Regards,
Robert

[rosangela]

Cannot link template when Zabbix Admin has read-only access to templates

The mentioned problem occurs from Zabbix frontend version 1.8.5 or upper, which requires to Zabbix Admin Read/Write access to the templates group in order to link templates to a new or existing host.
In Zabbix 1.8.3 it works exactly the way I wanted. The Zabbix Admin needs only ReadOnly access to the templates group and access Read/Write to the hosts groups he wants to.
Please, could someone fix the new versions of Zabbix?