Node management permissions needed when using Powershell to set node to "unmanaged"

Is the account a local Orion account or one from Active Directory? I've seen issues before with the SDK passing permissions using AD accounts, typically creating a local Orion account with a strong password has been my work-around.

It's a local Orion account, not from AD. We've installed this Version(s): Orion Platform 2019.2, IPAM 4.9.0, NCM 8.0, NPM 12.5, NTA 4.6.0, UDT 3.4.0, SAM 6.9.0, NetPath 1.1.5

do you mind sharing your API call here? I've used Unmanage a ton, but my service account for API calls does have elevated permissions. I'd like to try and emulate on our side for you so you can know if it's a bug to be logged with support.

CC: tdanner​ or dan jagnow​; they might know off the top of their heads if this is a known limitation as well

do you mind sharing your API call here? I've used Unmanage a ton, but my service account for API calls does have elevated permissions. I'd like to try and emulate on our side for you so you can know if it's a bug to be logged with support.

CC: tdanner​ or dan jagnow​; they might know off the top of their heads if this is a known limitation as well

I have confirmed that the API should not require node management rights.  The request to change that behavior is being tracked as internal issue CORE-12986.

to clarify, meaning that there's an internal issue tracking this bug because it shouldn't require node management rights, but it currently does requires those rights in the present state? or am I reading that wrong?

You are reading that correctly.  The rights required to use the API need to be adjusted so they match the rights required to perform the equivalent action from the website.  The website is working as intended.  The API is not.

Hi dan,

thank you. Would be very important to fix that, because the password needs to be stored in the script and is quite public then. Node management rights for that user account are pretty critical then.

Hi Dan,

are there any news regarding the permission issue CORE-12986 ?

Because the script we are using to set nodes to UNMANAGED can be called from everywhere and everyone, I cannot use password encryption technics because the encryption key then needs to be public also...

I have to rollout the script in production all would be fine if the account which is used only needs "Allow Account to Unmanage Objects & Mute Alerts" permissions.

Thanks!

CORE-12986 has gone through initial prioritization, but development hasn't started yet (at least from what I can see).  I updated the issue with a link to your most recent comment about your situation.

Hi, is there an update on that internal issue? I have a client that wants to use the unmanage verb but does not want the user to have node management rights.

I'm afraid that the internal issue hasn't yet been prioritized for inclusion in a release.  I added a note to the issue to capture the continued interest in getting it addressed.