Platform

Platform

A place for Apptio product users to learn, connect, share and grow together.

 View Only
Expand all | Collapse all

Automated User Download

  • 1.  Automated User Download

    Posted 11/23/17 03:34 AM

    Is there a way to create an automated download of all users and permissions from Frontdoor rather than having to pull them manually?

     

    We have an audit requirement to provide this information on a monthly basis.









    #Datalink


  • 2.  Re: Automated User Download

    Posted 11/27/17 04:27 PM

    Hi Julie,

     

    Can you send me a screenshot of the tabs you have access too in frontdoor? Do you see a "Reports" tab at the top of your screen as an option?

     

    Thanks,

    Lauren Griessel


    #Datalink


  • 3.  Re: Automated User Download

    Posted 11/28/17 03:49 AM

    Hi Lauren,

     

    Yes I see a report tab but I have to run that manually, I was wondering if there was an automated way of getting the report run on a weekly basis (via DataLink or API)?


    #Datalink


  • 4.  Re: Automated User Download

    Posted 11/28/17 11:07 AM

    Hi Julie,

    I will ask around and see if there is a way to run one automatically.

    Thanks,

    Lauren


    #Datalink


  • 5.  Re: Automated User Download

    Posted 12/05/17 07:25 PM

    HI Julie,

     

    The FrontDoor Product Manager @Arpitha Dhanapathi published an article after your request. Please review it and let us know if you have any questions: https://tbmcouncil.jiveon.com/docs/DOC-8489.

     

    Thank you so much for everyone who helped!

     


    #Datalink


  • 6.  Re: Automated User Download

    Posted 12/06/17 07:26 AM

    Thank you Lauren & Arpitha


    #Datalink


  • 7.  Re: Automated User Download

    Posted 01/05/18 09:35 AM

    Hi Julie,

     

     

    We have a SOX requirement for getting the users every week and for R11, I just used datalink to pull the list of users.

     

    I was curious to know what others do. What do you use for the automated pull of users and how do you schedule it? 

     

    Regards,

    Sanjay V.


    #Datalink


  • 8.  Re: Automated User Download

    Posted 01/05/18 09:45 AM

    Hi Sanjay, we're still waiting for Support to come back to me about how to run these out of FrontDoor for R12 so at the moment there isn't anything.

     

    Are you willing to provide more information on how you have set yours up for R11 using Datalink?


    #Datalink


  • 9.  Re: Automated User Download
    Best Answer

    Posted 01/05/18 01:40 PM

    Sure - in R11, the user groups are maintained in the User tabs in Apptio. And like every other table in apptio it has a Show API URL. So all you have to do is to provide datalink the API URL like as if you downloading a report via API. I have datalink connectors that pull this information from our three production instances every night.

     

    For R12 - the challenge is that the authentication mechanism is a two step process (as far as I know) which makes it difficult to use datalink. If you are open to using python and something like windows scheduler or cron - I might be able to help you. There are some sample scripts in community that really help.

    In a nutshell, here are the steps:

    1. Authenticate with Front door and get a token (see Basic authentication in Frontdoor using username/password (Outdated; click for updated version) )
      • Make an http POST call to: https://frontdoor.apptio.com/service/nonuilogin with the following headers:
      • headers to be sent with this request
        • Content-Type: application/json
      • payload
        • key: "ping_uname" value: "username@domain.com"
        • key: "ping_pwd" value: "secretpassword"
        • key: "consent-accepted" value: "yes"
      • You will get an http response of 200 if the authentication was successful. The response headers will look something like this
      • Content-Type: application/text; charset=utf-8
        apptio-opentoken: 1fa5284a6f157cb8f256490a0ef99c36cb3eedac998a8f08924a03fea6999f848a1aec27da52731c728f9e77678b595f
        Set-Cookie: apptio-opentoken=1fa5284a6f157cb8f256490a0ef99c36cb3eedac998a8f08924a03fea6999f848a1aec27da52731c728f9e77678b595f; Path=/; Domain=frontdoor.apptio.com; Secure; HTTPOnly
        renew_after: 1445976541123
        renew_till: 1446019441123
        valid_till: 1445979841123
        of which you want the value of apptio-opentoken. 
        BTW - if you want to do this using the cURL utility, it will look something like this in windows:
        curl -i https://frontdoor.apptio.com/service/nonuilogin -H "Accept:application/json" -H "content-type:application/json" -H "host:frontdoor.apptio.com" -d "{\"ping_uname\":\"sanjay.v.valiyaveettil@kp.org\",\"ping_pwd\":\"SECRET\"}"
    2. Make the connection to Front Door

     

    I was able to successfully retrieve users and list of roles using this approach.

     

    Some things to remember:

    1. If you have SSO configured, you will need a non-SSO service account
    2. I think cURL can be configured to store tokens so that you can run the scripts one after the other and get it to work. if you have someone handy with scripts that will also work.

     

    Ping me if you have any questions or face any challenges.

     

    A LOT of information I have mentioned above is available at:

    1. Goto Datalink and click on the gear icon and click on API Documentation
    2. Basic authentication in Frontdoor using username/password (Outdated; click for updated version) 
    3. DataLink API sample scripts 

     

    Regards,

    Sanjay V.


    #Datalink


  • 10.  Re: Automated User Download

    Posted 01/19/18 10:26 AM

    I wrote a PowerShell .ps1 for this purpose via FrontDoor.  You must authenticate via API calls.  For my script I am using a Windows 2012 R2 server with windows task scheduler.  Couple things to keep in mind.

     

    1. You can setup a secured API key if your environment utilizes SSO, this is done through the user account management in Frontdoor

    2. I masked the API key on our server and encrypted it due to security reasons

    3. This can be used to run against Active Directory to check for user account status (what I use it for) 

    4. I would suggest coping and pasting the below into PowerShell ISE for a better view of the code

    5. The first portion of the code can be used over again for authenticating via API key in R12 and pass the token in the -header switch for future API calls

     

    This script is pretty long and if you have any specific questions please let me know!

     

    #############################################################################################################

    #Script to use API calls for Apptio FrontDoor applications #
    #Script written by Robert Schneider December 15th 2017 currently using API Key #
    #############################################################################################################

    $PSScriptRoot = Split-Path $MyInvocation.MyCommand.Path -Parent #set the current path of the script Get-location |select path
    $secretkey = "$PSScriptRoot\secretkey.pwd" #setting path of secretkey file
    $publickey = "$PSScriptRoot\publickey.pwd" #setting path of publickey file

    if (((Test-Path $secretkey) -eq $false) -or (Test-Path $publickey) -eq $false){ #testing path for public / secret key file

    #below is a custom input form for the public/private key pair
    Add-Type -AssemblyName System.Windows.Forms
    Add-Type -AssemblyName System.Drawing

    $objForm = New-Object System.Windows.Forms.Form
    $objForm.Text = "Public/Private Key Entry"
    $objForm.Size = New-Object System.Drawing.Size(300,250)
    $objForm.StartPosition = "CenterScreen"

    $OKButton = New-Object System.Windows.Forms.Button
    $OKButton.Location = New-Object System.Drawing.Size(75,180)
    $OKButton.Size = New-Object System.Drawing.Size(75,23)
    $OKButton.Text = "OK"
    $OKButton.DialogResult = [System.windows.forms.dialogresult]::OK
    $objForm.AcceptButton= $OKButton
    $objForm.Controls.Add($OKButton)

    $CancelButton = New-Object System.Windows.Forms.Button
    $CancelButton.Location = New-Object System.Drawing.Size(150,180)
    $CancelButton.Size = New-Object System.Drawing.Size(75,23)
    $CancelButton.Text = "Cancel"
    $CancelButton.DialogResult = [System.windows.forms.dialogresult]::Cancel
    $objForm.AcceptButton= $CancelButton
    $objForm.Controls.Add($CancelButton)

    $objLabel = New-Object System.Windows.Forms.Label
    $objLabel.Location = New-Object System.Drawing.Size(10,20)
    $objLabel.Size = New-Object System.Drawing.Size(280,20)
    $objLabel.Text = "PLEASE ENTER PUBLIC KEY:"
    $objForm.Controls.Add($objLabel)

    $objTextBox = New-Object System.Windows.Forms.TextBox
    $objTextBox.Location = New-Object System.Drawing.Size(10,40)
    $objTextBox.Size = New-Object System.Drawing.Size(260,20)
    $objForm.Controls.Add($objTextBox)

    $objLabel = New-Object System.Windows.Forms.Label
    $objLabel.Location = New-Object System.Drawing.Size(10,100)
    $objLabel.Size = New-Object System.Drawing.Size(280,20)
    $objLabel.Text = "PLEASE ENTER PRIVATE KEY:"
    $objForm.Controls.Add($objLabel)

    $objTextBox2 = New-Object System.Windows.Forms.TextBox
    $objTextBox2.Location = New-Object System.Drawing.Size(10,120)
    $objTextBox2.Size = New-Object System.Drawing.Size(260,20)
    $objForm.Controls.Add($objTextBox2)

    $objForm.topmost = $true

    $result = $objform.ShowDialog()

    if ($result -eq [System.Windows.Forms.DialogResult]::OK)
    {
    $x= $objTextBox.Text
    $y= $objTextBox2.Text
    }
    if ($result -eq [System.Windows.Forms.DialogResult]::Cancel)
    {
    $wshell = New-Object -ComObject Wscript.Shell
    $wshell.Popup("YOU HAVE CANCELLED YOUR INPUT, PLEASE TRY AGAIN AND ENSURE YOU'RE SELECTING OK.",0,"Error")|Out-Null
    exit}

    #end of custom input form for the public/private key pair

    $x|ConvertTo-SecureString -AsPlainText -Force|convertFrom-SecureString > $publickey #exporting and encrypting publickey
    $y|ConvertTo-SecureString -AsPlainText -Force|convertFrom-SecureString > $secretkey #exporting and encrypting secretkey
    }

    $secretkeyplain = Get-Content -path $secretkey #pulling encrypted secretkey

    $publickeyplain = Get-Content -path $publickey #pulling encrypted publickey

    $PlainTextSecret= [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR( (ConvertTo-SecureString $secretkeyplain) )) #unencrypting secretkey

    $PlainTextPublic= [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR( (ConvertTo-SecureString $publickeyplain) ))#unencrypting publickey

    $string =@{keySecret=$PlainTextSecret;keyAccess=$PlainTextPublic} |convertto-json -compress #creating hash-table to pass public/private key pair to apptio

    $header = Invoke-WebRequest -Method Post -Uri 'https://frontdoor.apptio.com/service/apikeylogin' -ContentType "application/json" -Body $string |Select -ExpandProperty headers #retrieving key header for opentoken

    $opentoken=@{"apptio-opentoken"=$header."apptio-opentoken"} #must be in a table format for passing credentials must pass in -header parameter in invoke-restmethod (get) and Invoke-WebRequest (curl/post)

    #############################################################################################################
    #Remaining scripts are API calls using opentoken from authentication above must pass $opentoken in -header #
    #############################################################################################################

    #Be sure to replace {yourdomainhere} below with your domain**
    $users=Invoke-RestMethod -Method Get -Uri 'https://frontdoor.apptio.com/api/v2/users/search?domainName={yourdomainhere}&hideInactive=false&start=0&pageSize=100&sortBy=login' -headers $opentoken #getting user list and passing open token

    $login= @($users.data.objects.login) #setting objects to string

    $date=get-date -Format MMddyymmss #getting unique date time and second count for file export

    #foreach loop to check email of user accounts in Apptio against active directory and return active vs non-active users *excludes any logins with svc in the name
    foreach ($email in $login){
    $usercheck = get-aduser -Filter {mail -eq $email} -Properties mail |select mail
    if ([string]::IsNullOrEmpty($usercheck) -and $email -notmatch "svc_" -and $email -notmatch "service"){$email >>nonactive_users_$date.csv}
    elseif (-not [string]::IsNullOrEmpty($usercheck)){$email >>active_users_$date.csv}
    }


    #Datalink


  • 11.  Re: Automated User Download

    Posted 06/10/20 06:26 PM

    How do you pass parameters in the URL to correspond to global slicers on a report? The URL appears to be only relevant to a report component like a table which limits the use and interpretation if value of global slicers is not known 


    #Datalink