lm_device update doesn't work for non-admins

[ty733420]

SUMMARY

ISSUE TYPE

• Bug Report

COMPONENT NAME

lm_device with the "update" action.

ANSIBLE VERSION

ansible-playbook [core 2.11.3]
  config file = /mnt/smb/ansible_base/ansible.cfg
  configured module search path = ['/mnt/smb/ansible_base/plugins/modules']
  ansible python module location = /home/myuser@mycompany.com/.local/lib/python3.6/site-packages/ansible
  ansible collection location = /mnt/smb/ansible_base/collections
  executable location = /home/myuser@mycompany.com/.local/bin/ansible-playbook
  python version = 3.6.8 (default, Mar 18 2021, 08:58:41) [GCC 8.4.1 20200928 (Red Hat 8.4.1-1)]
  jinja version = 3.0.1
  libyaml = True

COLLECTION VERSION

Collection               Version
------------------------ -------
logicmonitor.integration 1.1.2

CONFIGURATION

ANSIBLE_FORCE_COLOR(/mnt/smb/ansible_base/ansible.cfg) = True
CALLBACKS_ENABLED(/mnt/smb/ansible_base/ansible.cfg) = ['timer']
COLLECTIONS_PATHS(/mnt/smb/ansible_base/ansible.cfg) = ['/mnt/smb/ansible_base/collections']
DEFAULT_FILTER_PLUGIN_PATH(/mnt/smb/ansible_base/ansible.cfg) = ['/mnt/smb/ansible_base/plugins/filters']
DEFAULT_GATHERING(/mnt/smb/ansible_base/ansible.cfg) = explicit
DEFAULT_HOST_LIST(/mnt/smb/ansible_base/ansible.cfg) = ['/mnt/smb/ansible_base/environments/shared', '/mnt/smb/an>
DEFAULT_LOOKUP_PLUGIN_PATH(/mnt/smb/ansible_base/ansible.cfg) = ['/mnt/smb/ansible_base/plugins/lookup']
DEFAULT_MODULE_PATH(/mnt/smb/ansible_base/ansible.cfg) = ['/mnt/smb/ansible_base/plugins/modules']
DEFAULT_ROLES_PATH(/mnt/smb/ansible_base/ansible.cfg) = ['/mnt/smb/ansible_base/roles']
DEFAULT_STDOUT_CALLBACK(/mnt/smb/ansible_base/ansible.cfg) = yaml
HOST_KEY_CHECKING(/mnt/smb/ansible_base/ansible.cfg) = False
INVENTORY_IGNORE_PATTERNS(/mnt/smb/ansible_base/ansible.cfg) = ['other_vars']

OS / ENVIRONMENT

Red Hat Enterprise Linux release 8.4 (Ootpa)

STEPS TO REPRODUCE

• Execute using the API credentials of a user that is not a full administrator of LogicMonitor, but has the permissions to create and manage devices under a particular group.
• Add a new device using either the "add" or "update" action
• Repeat that play again, making no changes

    - name: Add LogicMonitor Device
      logicmonitor.integration.lm_device:
        action: update
        company: mycompany
        access_id: myaccessid
        access_key: myaccesskey
        collector_group_name: mycollgrp
        hostname: '{{ inventory_hostname }}'
        display_name: '{{ inventory_hostname }}'
        auto_balance: true
        groups: 
          - mygroup/mysubgroup
        description: device added by Ansible
        disable_alerting: true
        properties: {
          snmp.community: commstring,
          type: dev
        }
      delegate_to: localhost

EXPECTED RESULTS

• The first execution should create the device with the appropriate options (yellow text)
• The second execution should succeed, without making changes (green text)

ACTUAL RESULTS

• The first execution creates the device with the appropriate options (yellow text)
• The second execution fails with the error "Permission denied, Changing name need the manage permission on all parent groups"

TASK [Add LogicMonitor Device] ***********************************************************************************
fatal: [myhost.mycompany.com -> localhost]: FAILED! => changed=false
  msg: |-
    Error: Failed to update device
    Response: {'errorMessage': 'Permission denied, Changing name need the manage permission on all parent groups.', 'errorCode': 1403, 'errorDetail': None}

[lm-carlos-alvarenga]

This error may be caused by not having manage permissions on the Minimal Monitoring device group. Each new device is automatically added to this device group so you'll need manage permissions on said group whenever modifying a device. Also, please make sure that manage permissions are enabled for all parent groups (e.g. mygroup), not just the subgroup containing the device. If this doesn't resolve the issue, enabling manage permission for All groups in the user role can also resolve the issue.

[ty733420]

Thanks for the response. My administrator believes I have the correct permissions and provided the following screenshot. The circled group is the group in which I'm trying to manage resources, and it is a top-level group.

[lm-carlos-alvarenga]

Do you have manage permissions on the Minimal Monitoring group? You will require permissions on that group to update any device/group.