Updating a Smart Group criteria From the API

[Lotusshaney]

Hi All,

Im quite new to Casper, only been using it for a little over 3 weeks but so far impressed.

Im looking to build a 3rd party Auto software updater for small apps like Skype etc. Now I have all of that done, my script downloads the current version, compares it to the installed one on our deployment and if it's newer replace it in a storage folder.

What I want to do is now force that out using Self Service or a policy. My idea was to use a smart group so that is does a check for Skype.app and check it's version number with a value I want to inject in from the script I have written. Then the users with outdated versions could Self Serve or I could force the update out.

I tried updating the MYSQL back end, and though the version number could easily be changed the JSS did not see my update. JAMF said the official way to access the database is via the API.

I've looked but I cant see a way of updating the smart group criteria from the API.

Any Ideas ?

Dan

[rockpapergoat]

unrelated to your question, but it sounds like you should check out munki. it does everything you mentioned, minus the casper API interaction.

http://code.google.com/p/munki/

[mm2270]

I don't know much about Munki (and only a little more about the Casper API for that matter) but I do know that first you need to either create an account or modify an existing one on your JSS with appropriate API Privileges. It could be an existing one, but I think best practice is to set up a separate API account that doesn't have access to the JSS GUI. Make sure that at least "Read" and "Update" are checked for the Computer Groups row. You may need Create and Delete too.
Have you looked at the API use examples that are included within your JSS? They are a good starting point, but often times you need to do a little deduction to figure out the right terms and syntax to make effective use of it.
In case you haven't seen that, use these with your JSS:

https://your.casper.server.com/apiFrontPage.rest
https://your.casper.server.com/apiIntro.rest

[Lotusshaney]

Hi guys

First of all I have used munki for over a year or so now. Very good product but what I'm trying to do is automate it completely so I don't have to repackage it. Ive moved to a new company and they have a large Casper deployment so I don't want to add another service into the mix if Casper can do it. If it can't then I'll recommend munki.

I've got full rights to the API. I've looked through all the examples and I can make a static group put I need to modify a dynamic group and I can't see anything to do this.

Dan

[mm2270]

Ah, maybe there isn't a way to modify Smart Group criteria. Its possible the "Computer Groups" only applies to static groups, but I'm not really sure.

[John_Wetter]

Hi Dan,
From your request, is the goal to create a 3rd party app for use in other environments, or is your goal to be able to track software versions for updates?

I'm thinking what you want to do is track what version is where and then if needed, just have it install the new version of the software. I don't see where munki gets you anything there. I'd just make a smart group based on the version and then just install the version you want on the ones not at the update level you want. It sounds like you've got the tools you need, so no need to introduce a wildcard that wouldn't be supported into the equation.

In this case, Munki sounds like a solution looking for a problem! ;-)

[rockpapergoat]

i mentioned munki only because it does everything you describe minus downloading the 3rd party software updates by itself. but you already know that, since you've used it elsewhere. i'd just hate to see you reinvent the wheel by developing yet another solution (yours) and integrating it with casper. i'm not familiar enough with the casper api to determine if you're barking up the wrong tree.

in my experience, people tend to ask "can casper do [xyz]?" and most of the time, my answer is a qualified "sort of," because it often requires writing the tools and logic to get there. that's fine, but i think lots of people get the idea it's some sort of one stop shop for mac administration, which is not the case.

i don't think munki is a solution looking for a problem unless you're committed and happy with the way casper or whatever management tools you have work.

regardless, i've gone off topic enough for now.

anybody have an answer about updating smart groups via the api?

[tlarkin]

Hey Daniel,

You can access the built in documentation for the API by going here on your JSS:

(it is built in to your JSS)
https://myjss.corp.com:8443/apiFrontPage.rest

Looking at the API documentation, and I openly admit I am still sort of green with the API myself, I am not seeing a clear solution to this. I also chatted with a developer on this to ensure I could suggest the proper path with the API.

My first initial thought with the API is use your version checking script to put the machine out of compliance in a static group in Casper. Then use that to scope out an upgrade. This seems like a lot of work, and it seems like it has some margin of error.

The next option would be smart groups. Scoped by app name and app version. Anything that is less than the required version is out of compliance and you can push out the app that way. I think this would be a ton easier and more efficient than using the API. Just set your smart group to have a lesser version than you require and this could show you all machines out of compliance with your requirements.

Another option would be to use notifications. You mentioned you wanted self service to be the way users upgrade their version of Skype. If you have a script that checks the version of skype you can have it run locally (set policy to run offline) and you can use notifications like AppleScript or say Growl, to notify your users that they are out of compliance and they need to upgrade via Self Service. By sheer annoyance of them getting that message they should upgrade. In the past when I was a System Administrator I used Growl for this very reason (though it used to be free back then). Anything that management deemed important, but wanted the users to choose when to do it (politics) I used Growl to notify them a lot, frequently, until they ran a policy. Then the policy itself would create a receipt file on the local box and if the receipt was present Growl stopped running. Now, that Growl is no longer free I would probably not use this. Also, while this was sort of fun to set up (yes I find this sort of thing fun, means I am in the right business) it definitely had it's own set of caveats.

Yet one more way would be to set up two policies. The first policy would be a Self Service policy which expires in x amount of days. This will allow the users to install the update via Self Service at their own leisure, and give them the free time to choose when is best to install the update. Then once that policy expires, start a new policy (which can be set automatically) to install the update via the normal framework settings with out user interaction, so every15, start up, login, logout, etc.

I hope these options help you figure out your solution. When you figure it out please post back so the community can benefit from it.

Thanks,
Tom