API: Access denied about check_pve

[fdellwing]

This seems to be a problem with PVE7:

root@proxmox-sgp:~# ./check_pve.py -u monitoring@pve -t monitoring=5e3dd1bd-xxxx-xxxx-xxxx-xxxxxxxxxxxx -e localhost -m version -k
OK - Your pve instance version '7.0-11' (63d82f4e) is up to date

I'm currently not sure where to find the problem. The API itself is working:

::1 - monitoring@pve!monitoring [24/11/2021:17:43:49 +0800] "GET /api2/json/cluster/status HTTP/1.1" 403 13
[...]
::ffff:62.x.x.x - root@pam [24/11/2021:17:45:04 +0800] "GET /api2/json/cluster/status HTTP/1.1" 200 136

An update to PVE 7.1-4 did not solve the problem.

[nbuchwitz]

Strange ... Which python version do you use?

[fdellwing]

The default one that comes with PVE7

root@proxmox-sgp:~# python3 -V
Python 3.9.2

[nbuchwitz]

Interesting, looks like the acl for the user needs to be active even if token based auth is used. I tested with a fresh setup and only created the acl for the token. The result was the same as yours. After adding the acl for the user aswell (pveum acl modify / --roles Monitoring --user 'monitoring@pve') it started working.

[fdellwing]

Can confirm that this solved the issue.