Commands - How to restrict access to individual arguments of a command

Command access can be restricted easily through the command permissions in Authentication, but with some additional work we can implement restriction to access to command arguments. To achieve this, access to the original command, whose arguments you want to change, needs to be restricted and then a new command with a reduced argument set has to be created.

There are many snooze commands for the various data items, based on the exit condition for the snooze:

If you just want to remove the ability to snooze on all Managed Entities rather than the whole Until severity changes snooze command, you need to remove the permission to the AllMe options and re-instate the new command which will execute the single instance option.

/geneos/gateway/directory/probe/managedEntity/sampler/dataview//cell /geneos/gateway/directory/probe/managedEntity/sampler/dataview /geneos/gateway/directory/probe/managedEntity/sampler /SNOOZE:dateTimeAllMe /SNOOZE:manualAllMe /SNOOZE:severityToAllMe /SNOOZE:severityToOrTimeAllMe /SNOOZE:timeAllMe /SNOOZE:untilChangesAllMe /SNOOZE:unsnoozeAllMe /SNOOZE:untilValueChanges

The preceding example contains a User account with the AllMe options removed and a new commandGroup which re-instates their single instance equivalents onto the xpaths where they didn’t exist before. The only exception to this is the /SNOOZE:untilValueChanges command where there doesn’t appear to be a single instance option, so this one selection still throws up the option for all managed entities.

Removing the popups Copied

You can improve on this further by removing the popup which appears each time (if this is undesirable). It works on all snooze commands including the /SNOOZE:untilValueChanges.

The solution is basically the same in that the User permissioning section applies none to all the AllMe commands, but instead of creating your own commands which invoke the single instance option, you create your own commands that invoke the same ALLMe ones again, but this time, provide the answer to the argument as this (it forces it to use the first this managed entity only argument). If you have tried this already, you will notice that an annoying pop up output window appears. This can also be prevented by ticking silent.

An example for the snooze manual can be found in the following xml:

<command name="Manual">
    <targets>
        <target>/geneos/gateway/directory/probe/managedEntity/sampler/dataview//cell</target>
        <target>/geneos/gateway/directory/probe/managedEntity/sampler/dataview</target>
        <target>/geneos/gateway/directory/probe/managedEntity/sampler</target>
    </targets>
    <task>
        <commands>
            <commandRef>
                <internalCommand>
                    <name>/SNOOZE:manualAllMe</name>
                </internalCommand>
                <stopOnError>true</stopOnError>
            </commandRef>
        </commands>
        <args>
            <arg>
                <targetArgs>
                    <targetArg>
                        <commandNumber>1</commandNumber>
                        <argNumber>5</argNumber>
                    </targetArg>
                </targetArgs>
                <static>this</static>
            </arg>
        </args>
        <silent>true</silent>
    </task>
</command>

Note

You need to go to the GSE help and look at Appendix: Internal Commands to check which argument number to provide the selection of this to as it isn’t always argument 5. For example, snooze timeAllMe takes ’this’ as argument 6.

For more information about command access, see Can commands be disabled or restricted for certain users?