jss.exceptions.JSSGetError: Response Code: 401 Response: Unauthorized. The request requires user authentication

[krispayne]

When trying to run spruce to get things setup, I run into this unauthorized error. AutoPKG is setup and has authentication details (and known to work) and I also set up python-jss authentication plists just in case. Is there something I'm missing?

[homebysix]

@krispayne: The permissions needed for Spruce are different (and broader) than the permissions needed for JSSImporter. So if you're attempting to use the same credentials that JSSImporter is using, that might produce this 401 error.

If you run Spruce regularly, I recommend creating a separate Spruce API user with the appropriate permissions. I don't have them itemized, but I think they would include Read and Delete access to the following:

• Computer
• ComputerGroup
• Package
• Script
• Policy
• ComputerConfigurationProfile
• MobileDevice
• MobileDeviceGroup
• MobileDeviceConfigurationProfile
• MobileApplication

And perhaps more.

[krispayne]

thanks @homebysix. I suppose that part is missed in the setup instructions. It mentions all you need is a working autopkg or jss-importer setup. I assumed it would use the same user.

[mrmte]

you get this error if you enabled sso in the jss

[WTaylorA]

Anyone using Spruce after the JSSImporter 1.0 update? No clue if that is the issue, but just stumbled across Spruce after upgrading JSSImporter. It looks awesome, but I'm seeing the same error when I run it - confirmed my AutoPKG preferences all seem good, JSSImporter working as expected, SSO is not enabled in my environment.

Haven't tried any of the "remove" options, but I have read access from the autopkg service account to all the categories listed above. Also running JAMF 10.x, so not sure if any of the required categories may have changed names and I'm missing an obvious one.

If I run "spruce.py -p" I get:

🌲 Building: Package Report... 🌲 Traceback (most recent call last): File "./spruce.py", line 1955, in main() File "./spruce.py", line 1951, in main run_reports(args) File "./spruce.py", line 1747, in run_reports results.append(func(**args_dict)) File "./spruce.py", line 733, in build_packages_report all_configs = jss_connection.ComputerConfiguration().retrieve_all() File "/Library/Python/2.7/site-packages/python_jss-1.5.0-py2.7.egg/jss/jamf_software_server.py", line 555, in ComputerConfiguration File "/Library/Python/2.7/site-packages/python_jss-1.5.0-py2.7.egg/jss/jamf_software_server.py", line 875, in get_object File "/Library/Python/2.7/site-packages/python_jss-1.5.0-py2.7.egg/jss/jamf_software_server.py", line 901, in get_list File "/Library/Python/2.7/site-packages/python_jss-1.5.0-py2.7.egg/jss/jamf_software_server.py", line 205, in get File "/Library/Python/2.7/site-packages/python_jss-1.5.0-py2.7.egg/jss/tools.py", line 89, in error_handler jss.exceptions.JSSGetError: Response Code: 401 Response: Unauthorized. The request requires user authentication

[grahampugh]

See #33 for a potential solution

[grahampugh]

@WTaylorA See @sheagcraig comment from 29 Nov 2016 above. Do you have all those permissions with you AutoPkg API user?

It is now possible to specify a different preferences file for use with Spruce. You could then create a different API user for use with Spruce with the additional permissions required.

Here's an example ~/Library/Preferences/spruce.plist:

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>API_PASSWORD</key>
    <string>SUPERSECRET</string>
    <key>API_USERNAME</key>
    <string>spruceuser</string>
    <key>JSS_REPOS</key>
    <array>
        <dict>
            <key>name</key>
            <string>JPShare</string>
            <key>password</key>
            <string>DISTRIBUTIONPOINTPASSWORD</string>
        </dict>
    </array>
    <key>JSS_URL</key>
    <string>https://jamf.url:8443</string>
</dict>
</plist>

Then you call Spruce like:

/path/to/spruce.py --prefs /Users/YOURUSER/Library/Preferences/spruce.plist 

(other parameters added as normal).

[sumitphogat13]

Hello guys I am getting unrecognized arguments error. spruce.py: error: unrecognized arguments: --prefs

[grahampugh]

@sumitphogat13 did you download the latest version of Spruce?

[sumitphogat13]

Yes trying this on Spruce-2.0.1/spruce.py --prefs with Spruce-2.0.1/spruce.py -h I don't see the prefs argument either. Anyway to troubleshoot around the existing pref file. I have valid account with required privileges, still getting above authentication error. I have tried removing python-JSS and jssimporter plist but still not getting prompt to manually enter credential in terminal. Not sure from where its fetching the creds

[grahampugh]

@sumitphogat13 you say you don't see --prefs in the -h options? Then you don't have the latest version. 2.0.1 is from 2016, but if you download the latest spruce.py you get the --prefs option. I'll try and create a new release zip/tar.gz.

When you have the latest version, note that --prefs requires a prefs file - it's not an interactive option. So the syntax is ./spruce.py --prefs /path/to/file [other options].

[sumitphogat13]

Thanks Graham. I see 2.0.1 as the latest under releases and thought that is the latest version. I have downloaded the latest now and can see pref with -h Yes I used the proper syntax with reference to the pref file. Thanks for clarifying the release. Appreciate your active response. Thanks a lot.

Now Getting Error TypeError: retrieve_all() got an unexpected keyword argument 'subset' cmd: /PATH/Spruce-master/spruce.py -p --prefs /PATH/Preferences/com.github.spruce.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>API_PASSWORD</key>
    <string>****</string>
    <key>API_USERNAME</key>
    <string>***</string>
    <key>JSS_REPOS</key>
    <array>
        <dict>
            <key>URL</key>
            <string>smb://****</string>
            <key>name</key>
            <string>****</string>
            <key>password</key>
            <string>******</string>
            <key>port</key>
            <string>139</string>
            <key>share_name</key>
            <string>CasperShare</string>
            <key>type</key>
            <string>SMB</string>
            <key>username</key>
            <string>casperadmin</string>
        </dict>
    </array>
    <key>JSS_URL</key>
    <string>https://jamf.url:8443</string>
</dict>
</plist>

[grahampugh]

@sumitphogat13 Please try the latest commit of Spruce. It should address your subset issue.