To follow up on my earlier post about creating API roles with all available privileges, I’ve developed a script which will create API Roles with API privileges that are roughly equivalent to the API privileges for Jamf Pro accounts which have been assigned the following Jamf Pro account privilege sets:

• Administrator: Grants all account privileges
• Auditor: Grants all account read privileges

For more details, please below the jump.

The script is named create_jamf_pro_api_role_with_auditor_or_administrator_privileges.sh and is available via the link below:

https://github.com/rtrouton/rtrouton_scripts/tree/main/rtrouton_scripts/Casper_Scripts/create_jamf_pro_api_role_with_auditor_or_administrator_privileges

This script performs the following actions:

• Create a new API role on a Jamf Pro server.
• Assign all necessary API privileges to that newly-created API role.

Three items are required to use this script:

• The URL of the appropriate Jamf Pro server.
• The Client ID for a Jamf Pro API client with all necessary API privileges assigned to it.
• The Client Secret for that Client ID.

As mentioned in my previous post, Jamf Pro enforces a privilege-escalation guard, where an API Client can’t be used to authenticate an API call which creates a API Role and assigns API privileges to that API Role which the API Client does not already hold itself. What this means is that the API clients used to authenticate must have the following minimum API privileges associated with them:

Creating an Auditor-equivalent API Role

• All API privileges whose name starts with Read
• Create API Roles
• Update API Roles

Creating an Administrator-equivalent API Role

• All available API privileges

Note: API privileges starting with View (for example, the View Disk Encryption Recovery Key API privilege) are intentionally excluded from being assigned to the Auditor-equivalent API Role, even though they are also read-only in nature. This is because the View permissions may provide access to information not available to Jamf Pro user accounts which have been assigned the Auditor account privileges set. If View privileges are needed for the API Role being created, you will need to add them following the creation of the new API role by this script.

For this example, I want to create a new API role named All Read API Privileges Granted. To do so, I’m using an API Client which has been assigned the following permissions:

•  All API privileges whose name starts with Read
• Create API Roles
• Update API Roles

When the script is run, I’m selecting the Auditor choice when prompted for the privilege set.

With the example conditions, you should see similar output to what’s shown below when using the script to create the new All Read API Privileges Granted API Role:

You should then be able to check on the Jamf Pro server and verify that the All Read API Privileges Granted API Role has been created and that it has all API privileges whose name starts with Read assigned to it.

As part of its run, the script will verify if the API Client being used to create the API Role itself has all relevant API privileges assigned to it. If the API Client does not have all of the necessary API privileges assigned to it, it will stop and display warnings similar to what is shown below: