I watched the presentation given by @chadlawson and uploaded to the Rocketman Tech channel on YouTube (https://youtu.be/6xVmJqpbEHI) over the weekend. I decided to dive in and change a script that puts a machine into a static group (credit to @sdagley ) but whilst I can see that I'm getting a token, the computer is not going into the Static Group. The reason for changing from Basic Auth to Bearer Token Auth is because Basic Auth is deprecated so I'm trying to get this figured out before there's a panic.
Just wondering if anyone can see where I'm going wrong or suggest a better way to do this? The first script below is my working script using Basic Auth and the second longer one is the one using Bearer Token Auth. The second script is mostly using code from Rich Trouton's blog on Bearer Tokens and I do get the Bearer Token but whilst I seem to have no errors, the machine is not added to the static group.
#!/bin/sh
# AddComputerToStaticGroup.sh
# Adds the computer to a static group
# https://www.jamf.com/jamf-nation/discussions/36323/script-to-add-to-static-group
#API login info
apiuser="apiusernamehere"
apipass='apipasswordhere'
jamfProURL="https://yourserver.jamfcloud.com"
#ComputerName=$(/usr/sbin/scutil --get ComputerName)
ComputerName="ComputerNameThatExistsInServer"
# My test static group is called TestGroup and has ID of 3
GroupID="3"
GroupName="TestGroup"
apiURL="JSSResource/computergroups/id/${GroupID}"
#XML header stuff
xmlHeader="<?xml version=\\"1.0\\" encoding=\\"UTF-8\\"?>"
apiData="<computer_group><id>${GroupID}</id><name>${GroupName}</name><computer_additions><computer><name>$ComputerName</name></computer></computer_additions></computer_group>"
curl -sSkiu ${apiuser}:${apipass} "${jamfProURL}/${apiURL}" \\
-H "Content-Type: text/xml" \\
-d "${xmlHeader}${apiData}" \\
-X PUT > /dev/null
#!/bin/sh
# Adapted from https://derflounder.wordpress.com/2022/01/05/updated-script-for-obtaining-checking-and-renewing-bearer-tokens-for-the-classic-and-jamf-pro-apis/
# This script uses the Jamf Pro API to get an authentication token
# Explicitly set initial value for the api_token variable to null:
api_token=""
# Explicitly set initial value for the token_expiration variable to null:
token_expiration=""
# Set the Jamf Pro URL here if you want it hardcoded.
jamfpro_url="https://yourserver.jamfcloud.com"
jamfpro_user="apiusernamehere"
jamfpro_password='apipasswordhere'
# Remove the trailing slash from the Jamf Pro URL if needed.
jamfpro_url=${jamfpro_url%%/}
GetJamfProAPIToken() {
# This function uses Basic Authentication to get a new bearer token for API authentication.
# Use user account's username and password credentials with Basic Authorization to request a bearer token.
if [[ $(/usr/bin/sw_vers -productVersion | awk -F . '{print $1}') -lt 12 ]]; then
api_token=$(/usr/bin/curl -X POST --silent -u "${jamfpro_user}:${jamfpro_password}" "${jamfpro_url}/api/v1/auth/token" | python -c 'import sys, json; print json.load(sys.stdin)["token"]')
else
api_token=$(/usr/bin/curl -X POST --silent -u "${jamfpro_user}:${jamfpro_password}" "${jamfpro_url}/api/v1/auth/token" | plutil -extract token raw -)
fi
}
APITokenValidCheck() {
# Verify that API authentication is using a valid token by running an API command
# which displays the authorization details associated with the current API user.
# The API call will only return the HTTP status code.
api_authentication_check=$(/usr/bin/curl --write-out %{http_code} --silent --output /dev/null "${jamfpro_url}/api/v1/auth" --request GET --header "Authorization: Bearer ${api_token}")
}
CheckAndRenewAPIToken() {
# Verify that API authentication is using a valid token by running an API command
# which displays the authorization details associated with the current API user.
# The API call will only return the HTTP status code.
APITokenValidCheck
# If the api_authentication_check has a value of 200, that means that the current
# bearer token is valid and can be used to authenticate an API call.
if [[ ${api_authentication_check} == 200 ]]; then
# If the current bearer token is valid, it is used to connect to the keep-alive endpoint. This will
# trigger the issuing of a new bearer token and the invalidation of the previous one.
if [[ $(/usr/bin/sw_vers -productVersion | awk -F . '{print $1}') -lt 12 ]]; then
api_token=$(/usr/bin/curl "${jamfpro_url}/api/v1/auth/keep-alive" --silent --request POST --header "Authorization: Bearer ${api_token}" | python -c 'import sys, json; print json.load(sys.stdin)["token"]')
else
api_token=$(/usr/bin/curl "${jamfpro_url}/api/v1/auth/keep-alive" --silent --request POST --header "Authorization: Bearer ${api_token}" | plutil -extract token raw -)
fi
else
# If the current bearer token is not valid, this will trigger the issuing of a new bearer token
# using Basic Authentication.
GetJamfProAPIToken
fi
}
InvalidateToken() {
# Verify that API authentication is using a valid token by running an API command
# which displays the authorization details associated with the current API user.
# The API call will only return the HTTP status code.
APITokenValidCheck
# If the api_authentication_check has a value of 200, that means that the current
# bearer token is valid and can be used to authenticate an API call.
if [[ ${api_authentication_check} == 200 ]]; then
# If the current bearer token is valid, an API call is sent to invalidate the token.
authToken=$(/usr/bin/curl "${jamfpro_url}/api/v1/auth/invalidate-token" --silent --header "Authorization: Bearer ${api_token}" -X POST)
# Explicitly set value for the api_token variable to null.
api_token=""
fi
}
GetJamfProAPIToken
APITokenValidCheck
echo "$api_authentication_check"
echo "$api_token"
CheckAndRenewAPIToken
APITokenValidCheck
echo "$api_authentication_check"
echo "$api_token"
#ComputerName=$(/usr/sbin/scutil --get ComputerName)
ComputerName="ComputerNameThatExistsInServer"
# My test static group is called TestGroup and has ID of 3
GroupID="3"
echo "GroupID: $GroupID"
GroupName="TestGroup"
echo "GroupName: $GroupName"
apiURL="JSSResource/computergroups/id/${GroupID}"
echo "apiURL: $apiURL"
#XML header stuff
xmlHeader="<?xml version=\\"1.0\\" encoding=\\"UTF-8\\"?>"
echo "xmlHeader: $xmlHeader"
apiData="<computer_group><id>${GroupID}</id><name>${GroupName}</name><computer_additions><computer><name>$ComputerName</name></computer></computer_additions></computer_group>"
echo "apiData: $apiData"
curl -sSkiu "Authorization: Bearer ${api_token}" "${jamfpro_url}/${apiURL}" \\
-H "Content-Type: text/xml" \\
-d "${xmlHeader}${apiData}" \\
-X PUT > /dev/null
InvalidateToken
APITokenValidCheck
echo "$api_authentication_check"
echo "$api_token"
