Hey all,
I am running a Panorama PAN-OS version 11.2.0 instance that managed two Firewall devices, running PAN-OS 11.1.0 and 11.2.7-hc13
I have a question about committing changes to a given template stack / device group for a specific admin account.
Before I commit to the template stacks / device groups / templates, I first make an API call to commit a partial change, scoped to the admin user:
/api/?&type=commit&action=partial&cmd=<commit><partial><admin><member>{ServerUserName}</member></admin></partial></commit>
This API request appears to be working fine today: Panorama registers it as a valid job and successfully processes it.
I notice that when I try to scope my template stack commit calls to a specific user, Panorama isn't pushing the changes to the template stack. Instead, it still remains in the Push to Device queue.
This is the API call I am making to scope the template stack call to a specific admin user:
/api/?&type=commit&action=all&cmd=<commit-all><template-stack><admin><member>{ServerUserName}</member></admin><exclude-other-admins>yes</exclude-other-admins><name>{templateStack}</name></template-stack></commit-all>
While this API call does appear to be processed successfully by Panorama (it returns a job ID and the associated job ID ends up with a SUCCESS status), I do not see the changes made by the admin user actually make it to the firewall associated with the template stack. However, if I remove the admin specification from this API call, it does push the changes to the firewall but it includes all changes associated with the template stack, not just the changes made by the admin user:
/api/?&type=commit&action=all&cmd=<commit-all><template-stack><name>{templateStack}</name></template-stack></commit-all>
Based on the API documentation for my Panorama instance, it should be able to filter the device push to the admin user, but I'm not seeing it push the changes to the target template stack. Is there a required step or parameter I'm missing, or a nuance in how PAN-OS attributes committed changes to a specific admin, that would explain this? Or is this genuinely not working as documented?
I've confirmed with Panorama's own API browser that admin, exclude-other-admins, and name are all valid children of template-stack under commit-all for my build, so schema-wise the request appears to be valid.
After doing a little more troubleshooting and stepping through some breakpoints, I think I may have found a potential bug in Panorama?
After importing a certificate into Panorama but before running the partial commit API call, I see the Commit to Panorama queue correctly has the expected objects attributed to my API user.
However, after running the partial commit API call and waiting for it to complete, I now see entries show up in the Push to Devices dialog, but the list is missing Admin attribution. The Admin field for these entries is empty.
That makes sense as to why scoping my API on template stacks to specific admins isn't doing anything. The question is whether this is a bug or there's an issue with my partial commit API call? Am I missing something that would prevent the admin attribution from being preserved on the running configuration?
