topic Re: CUCM 10.5.2 - SXML DimeGetFileService API issue in Management

CUCM 10.5.2 - SXML DimeGetFileService API issue

Francesco La Bella — Thu, 06 Aug 2015 10:54:21 GMT

Hi,

I'm using the SXML API DimeGetFileService (OneFile), to get from the CUCM some logs files via HTTP. Upgrading from 9.1 to 10.5 calls to the logcollectionservice/services/DimeGetFileService GetOneFile API fail with the error "file not allowed for download":

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><soapenv:Body><soapenv:Fault><faultcode>soapenv:Server.generalException</faultcode><faultstring>DimeGetFileService:GetOneFile(): file not allowed for download: /var/log/active/syslog/messages</faultstring><detail><ns1:stackTrace xmlns:ns1="http://xml.apache.org/axis/">DimeGetFileService:GetOneFile(): file not allowed for download: /var/log/active/syslog/messages at com.cisco.ccm.serviceability.soap.LogCollection.GetFile.DimeGetFileService.GetOneFile(Unknown Source) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:606) at org.apache.axis.providers.java.RPCProvider.invokeMethod(RPCProvider.java:397) at org.apache.axis.providers.java.RPCProvider.processMessage(RPCProvider.java:186) at org.apache.axis.providers.java.JavaProvider.invoke(JavaProvider.java:323) at org.apache.axis.strategies.InvocationStrategy.visit(InvocationStrategy.java:32) at org.apache.axis.SimpleChain.doVisiting(SimpleChain.java:118) at org.apache.axis.SimpleChain.invoke(SimpleChain.java:83) at org.apache.axis.handlers.soap.SOAPService.invoke(SOAPService.java:454) at org.apache.axis.server.AxisServer.invoke(AxisServer.java:281) at org.apache.axis.transport.http.AxisServlet.doPost(AxisServlet.java:699) at javax.servlet.http.HttpServlet.service(HttpServlet.java:646) at org.apache.axis.transport.http.AxisServletBase.service(AxisServletBase.java:327) at javax.servlet.http.HttpServlet.service(HttpServlet.java:727) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at com.cisco.vos.platform.tomcat.valves.CiscoResponseHeaderFilter.doFilter(Unknown Source) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:613) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:950) at org.apache.catalina.authenticator.SingleSignOn.invoke(SingleSignOn.java:312) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:421) at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1074) at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611) at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:314) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:745) </ns1:stackTrace><ns2:hostname xmlns:ns2="http://xml.apache.org/axis/">ucrmsxrsub01</ns2:hostname></detail></soapenv:Fault></soapenv:Body></soapenv:Envelope>

With CUCM 9.1.2 the same API works fine, with 10.5.2 it fails. Has someone experienced something similar? I cannot figure out what's changed with new 10.5 APIs (can't find any documentation).

If someone has any information about it, please share!

Thanks in advance.

Regards,

Francesco

Re: CUCM 10.5.2 - SXML DimeGetFileService API issue

npetrele — Thu, 06 Aug 2015 19:58:13 GMT

Can you post the XML request you're using? You can sanitize anything that you want to remain private.

Re: CUCM 10.5.2 - SXML DimeGetFileService API issue

Francesco La Bella — Thu, 06 Aug 2015 21:29:51 GMT

Hi Nicholas,

here the XML request:

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.cisco.com/ast/soap/">

<soapenv:Header/>

<soapenv:Body>

<soap:GetOneFile soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">

<FileName xsi:type="get:FileName" xmlns:get="http://cisco.com/ccm/serviceability/soap/LogCollection/GetFile/">/var/log/active/platform/cli/phones-rep-PST.txt</FileName>

</soap:GetOneFile>

</soapenv:Body>

</soapenv:Envelope>

I'm trying to download a file generated by a risdb command on CUCM. In CUCM version 9.1 all work fine.

I get the same error even using the SoapUI test tool.

Thanks in advance,

Francesco

Re: CUCM 10.5.2 - SXML DimeGetFileService API issue

Francesco La Bella — Fri, 07 Aug 2015 07:27:20 GMT

I'm doing other tests on this, and I found that for some files it works correctly. For example, if I try to download a file in the Tomcat Logs folder, the API is executed. Below, working XML request:

<soapenv:Header/>

<soapenv:Body>

<soap:GetOneFile soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">

<FileName xsi:type="get:FileName" xmlns:get="http://cisco.com/ccm/serviceability/soap/LogCollection/GetFile/">/var/log/active/tomcat/logs/localhost.2015-08-03.log</FileName>

</soap:GetOneFile>

</soapenv:Body>

</soapenv:Envelope>

Could it be a permission issue on some folders? I'm using an application user belonging to the following groups:

Standard CCM Superuser
Standard CCM Server Monitoring
Standard RealtimeAndTraceCollection

It seams no other groups are related to the use of SXML APIs.

Ciao,

Francesco

Re: CUCM 10.5.2 - SXML DimeGetFileService API issue

npetrele — Fri, 07 Aug 2015 19:28:53 GMT

Hi Francesco,

Yes, that's what I suspect it is. In CUCM (logged in as an administrator), go to User Management -> User Settings -> Role, and take a look at the roles your system has defined and what privileges they afford. You can always define a new role, too, and assign it the privileges you need for your application. Also, check out User Management -> User Settings -> Access Control Group.

Unless you just mis-typed it, maybe someone has defined new roles and permissions and you're not getting the permissions you expect. On our lab, the ACL is called Standard CCM Super Users, not Standard CCM Superuser.

Re: CUCM 10.5.2 - SXML DimeGetFileService API issue

endamcm79 — Mon, 11 Jan 2016 14:35:09 GMT

Hi Francesco,

Did you manage to resolve this?

I am encountering the same issue.

Thanks,

Enda

Re: CUCM 10.5.2 - SXML DimeGetFileService API issue

Alexey Smirnov — Mon, 08 Feb 2016 15:05:03 GMT

Looks like there is a bug with DimeGetFileService API GetOneFile() on CUCM 10.5.2 CSCuv89821

I've tried to move Cisco AMC service logs to IM&P server, but got the same error.