API: Smart Group with Parenthesis?

[bkerns]

Fairly new Casper Admin here (previously Munki admin) working on some automation.

Question I have been boxing with:

Is it possible to use the API to create a Smart Group with parenthesis used for grouping in its definition? I've been racking my head trying to figure out how, and hoping its just something simple I am overlooking!

Thanks all!

[bpavlov]

Certainly possible via the JSS GUI. What have you tried so far?

[mm2270]

Yes, but keep in mind if you are creating an XML file to send back up to the API to create the group. all special characters must be escaped into their proper encoding, or the xml file will be invalid and the API won't accept it. Its because xml uses some characters as tags or attributes, so if they are included in strings, the xml becomes malformed. Not sure of exactly how you are trying to create the Smart Group via the API since you didn't post an example script, but that may be the issue.

If you are making an xml file, I've often found it useful when scripting it this way to send the resulting file through xmllint to check the format, such as:

xmllint --format /path/to/myfile.xml

If it exits with a 0 status, its good, if not, its malformed and something needs to be fixed. The nice thing about xmllint is that it will actually print out where the problem in the file is so it makes it easier to go back and fix the issue.

EDIT: In doing a quick test, it looks like it handles paren marks just fine in an xml file, so its not one of the character sets that needs to be escaped from what I can tell, unlike say <, >, &, ", etc.
So, next question then is, how are you trying to create the Smart Group?

[chris_kemp]

I just started working on something similar (although not with the parentheses) - can you share what you've got? :)

[bkerns]

@mm2270 - So, yes, I am using an xml file in conjunction with Autopkg/JSSImporter, which is working great apart from defining the parenthesis in the group xml. I guess what I'm not seeing is how the API expects the xml to be formatted to indicate the opening and closing of the parenthesis, as the output that is spit back when you read it out of an existing one doesn't include them. And thus far I haven't found any further documentation.

[bkerns]

@chris.kemp I am using Autopkg/JSSImporter for automating the downloading, packaging, smart group and policy creation. I can't really take credit for what I'm using, as many many .jss recipes already exist, and I am really just customizing to suit my specific JSS organizational structure. But, I will be creating some .jss recipes that don't currently exist and they will be shared into Autopkg via Github.

Admittedly, it takes some initial setup, but well worth it in my opinion, and no need to reinvent the wheel! Certainly worth checking out to see if it suits what you need!

[mm2270]

@bkerns Any way you can post a sanitized version of either the script that's creating the xml, or an example xml file itself so we can see? I had done a very rough test of generating an xml file with a string that included open and close parens between tags, and the resulting xml file contained them just fine. What I didn't do is try to upload one to the JSS, so I don't know if perhaps the API is stripping characters out.

[bkerns]

So this is the xml from the criteria of an existing smart group that, in the GUI, contains parenthesis:

<criteria> <size>4</size> <criterion> <name>Application Title</name> <priority>0</priority> <and_or>and</and_or> <search_type>is</search_type> <value>Adobe Acrobat Pro.app</value> </criterion> <criterion> <name>Application Version</name> <priority>1</priority> <and_or>and</and_or> <search_type>like</search_type> <value>11.</value> </criterion> <criterion> <name>Application Version</name> <priority>2</priority> <and_or>and</and_or> <search_type>is not</search_type> <value>11.0.12</value> </criterion> <criterion> <name>Computer Group</name> <priority>3</priority> <and_or>and</and_or> <search_type>member of</search_type> <value>Release : Untested</value> </criterion>
</criteria>

What I am trying to discern is how to indicate something like:

<criteria> <size>4</size> <PARENTHESIS> <criterion> <name>Application Title</name> <priority>0</priority> <and_or>and</and_or> <search_type>is</search_type> <value>Adobe Acrobat Pro.app</value> </criterion> <criterion> <name>Application Version</name> <priority>1</priority> <and_or>and</and_or> <search_type>like</search_type> <value>11.</value> </criterion> <criterion> <name>Application Version</name> <priority>2</priority> <and_or>and</and_or> <search_type>is not</search_type> <value>11.0.12</value> </criterion> </PARENTHESIS> <criterion> <name>Computer Group</name> <priority>3</priority> <and_or>and</and_or> <search_type>member of</search_type> <value>Release : Untested</value> </criterion>
</criteria>

Does that make sense?

[bkerns]

I guess I possibly wasn't clear in that, I am not just trying to use the parenthesis as a character in one of the fields, but rather the parenthesis as they exist in the GUI for defining grouping in the definition.

[chris_kemp]

Interesting. Ok, so what I'm doing isn't really like that - for one thing, I don't want to use an XML file, just a script to interact with the API. My task is relatively simple, but I'm new to the API as well and am still trying to sort the syntax for what I'm trying to achieve.

Good luck, though! :)

[nessts]

I think if it were me I might make the smart group in the web interface, pull down the XML to see what it looks like and then you should know what to format your request like.

[tlarkin]

I think what @bkerns is talking about is the operators in Smart Groups where you can use Operator Precendence. If you go into the web console and manually create a smart group with these operators in place and do a GET request I do not see them in the XML anywhere.

I will investigate further. I also suggest contacting your JAMF Technical Account Manager and open up a ticket against this issue. Here is my test Smart Group I created:

Here is the GET request against that Smart Group

<?xml version="1.0" encoding="UTF-8"?>
<computer_group>
  <id>8</id>
  <name>test smart group</name>
  <is_smart>true</is_smart>
  <site>
    <id>-1</id>
    <name>None</name>
  </site>
  <criteria>
    <size>3</size>
    <criterion>
      <name>Operating System</name>
      <priority>0</priority>
      <and_or>and</and_or>
      <search_type>like</search_type>
      <value>10.10</value>
    </criterion>
    <criterion>
      <name>Model</name>
      <priority>1</priority>
      <and_or>and</and_or>
      <search_type>like</search_type>
      <value>15-inch MacBook Pro (Mid 2012)</value>
    </criterion>
    <criterion>
      <name>FileVault 2 Partition Encryption State</name>
      <priority>2</priority>
      <and_or>and</and_or>
      <search_type>is</search_type>
      <value>Encrypted</value>
    </criterion>
  </criteria>
  <computers>
    <size>0</size>
  </computers>
</computer_group>

So, this may not be a current feature of the API. I am going to investigate it further to find out, and in the meantime please contact JAMF Support and create a support ticket with this issue, so we can better track it internally.

Thanks,
Tom

[mm2270]

Yeah, I understand now what you're after. It wasn't clear before. I don't think that's possible via the API. Actually, when I've looked at Smart Group items via the API with and without those parenthesis in place, I don't believe I've actually seen a difference in the two. Obviously there is a difference in how they operate, but not sure if its possible to create one using that function through the API.

@tlarkin Let us know what you find out on this, as I'll be interested to know if its possible as well.

[bkerns]

Yes, @tlarkin clarified what I'm trying to get at perfectly. The parenthesis for Operator Precedence is what I am referring to, and the specification of those when defining a group with the API XML. I will certainly contact our Technical Account Manager and get a ticket opened up. Thanks!

[tlarkin]

Not a MySQL DBA wizard here, but in MySQL I believe AND comparisons are always compared first before an OR comparison. You can leverage Operator Precedence to get the data sets you want.

For example:

1 and 2 or 3

1 and 2 would be compared first, but maybe you wanted this:

1 and ( 2 or 3)

This would compare 2 or 3 first. Another you can use those in conjunction with any criteria with AND or OR as your comparison, but you may want a specific comparison to happen first.

EDIT

Application versions would be a better test of this for sure. I gotta jet onsite right now but I can test that later on and see what I find. Will update this thread later when time permits.

Thanks
Tom

[tlarkin]

So update here. I created a smart group based on Application version because I thought it would be a better test case, and here are the criteria for this smart group:

I do a GET request via curl and get this:

$ curl -sk -u tlarkin https://casper9gm.local:8443/JSSResource/computergroups/id/8 | xmllint --format -
Enter host password for user 'tlarkin':
<?xml version="1.0" encoding="UTF-8"?>
<computer_group>
  <id>8</id>
  <name>test smart group</name>
  <is_smart>true</is_smart>
  <site>
    <id>-1</id>
    <name>None</name>
  </site>
  <criteria>
    <size>4</size>
    <criterion>
      <name>Operating System</name>
      <priority>0</priority>
      <and_or>and</and_or>
      <search_type>like</search_type>
      <value>10.10</value>
    </criterion>
    <criterion>
      <name>Application Title</name>
      <priority>1</priority>
      <and_or>and</and_or>
      <search_type>is</search_type>
      <value>Adobe Flash Player Install Manager.app</value>
    </criterion>
    <criterion>
      <name>Application Version</name>
      <priority>2</priority>
      <and_or>and</and_or>
      <search_type>is</search_type>
      <value>18.0.0.209</value>
    </criterion>
    <criterion>
      <name>Application Version</name>
      <priority>3</priority>
      <and_or>or</and_or>
      <search_type>like</search_type>
      <value>17.0</value>
    </criterion>
  </criteria>

Still do not see an XML option for the parenthesis. I have already filed an internal bug on this and it looks like the only way to get those in there is after your automated API creation of said smart group log into the web console and manually add your parenthesis. Sorry if this is a huge inconvenience to anyone, and for everyone's reference it is filed under D-009422.

Please contact JAMF Support if you have any further issues/questions regarding this specific feature in the API.

Thanks,
Tom

[bkerns]

@tlarkin Thanks much for looking into this. Looks like you arrived at the same conclusion that I had. I am currently just adding the grouping after the fact in the GUI, but was hoping to get it as automated as possible. I do make use of the comparison order that you mention when possible, but sometimes the need for the true grouping is just unavoidable. Thanks for you attention to this, and for your information!

[mm2270]

I had found that the parenthesis weren't showing up in the API (nor a way to add them in programmatically) a while ago and I'm sorry I never reported this to JAMF. I guess I didn't think it was actually possible so I assumed this was by design. Thanks @tlarkin for submitting a defect for this. It would be great to be able to do as much as possible via the API as we can, so hopefully this will be added in the future.

[raymond_lyon]

For anyone who found this post on Google (like me), the above issue has been fixed in current versions of JAMF Pro. It's not documented anywhere I can find, but JAMF support was able to provide the operator. Here's an example:
Note the <opening_peren> and <closing_peren>

....
<criterion>
   <name>FileVault 2 Individual Key Validation</name>
   <priority>0</priority>
   <and_or>and</and_or>
   <search_type>is</search_type>
   <value>Valid</value>
<opening_paren>true</opening_paren>
<closing_paren>false</closing_paren>
</criterion>
<criterion>
   <name>FileVault 2 Status</name>
   <priority>1</priority>
   <and_or>and</and_or>
   <search_type>is</search_type>
   <value>Boot Partitions Encrypted</value>
<opening_paren>false</opening_paren>
<closing_paren>true</closing_paren>
</criterion>
...