Subsections


Baculum API and Web GUI Tools

This chapter presents the Bacula Web based interface that has been added to the Bacula project for version 7.0 and later.

New Features in 9.6.0

Support for commands that can take a long time

Some commands executed in bconsole can take a long time. They are for example: label tape volumes in autochanger, update slots without barcodes, estimate job command. To Baculum has been added support for these long time taking actions. Previously if command took time longer than 30 seconds, the request timed out.

Note On the Baculum API side has been changed way of sending requests for the above command. More details about it you can find in the Baculum API documentation.

Support for SELinux

There are new SELinux policy modules for Baculum API and Baculum Web. They can be applied manually or by installing new rpm packages available in Baculum repositories for CentOS and Fedora:

Graphical client status

In Baculum Web on the client page is available new graphical client client.

Graphical running job status

In Baculum Web on the running job page is available new graphical running job status that shows detailed information about current job. For backup job type the status also displays file and byte progress bars which base on estimated values.

Capability to start, stop and restart components

In Baculum API and Baculum Web are now available actions to start, stop and restart Bacula components. Actions can be defined by users and they can be executed from Baculum Web interface or directly by sending requests to Baculum API.

Statistics configuration

Statistics resource provides new feature in Bacula that enables saving Bacula component statistics to external databases such as Graphite or CSV file. The statistics are now configurable on the Baculum interface.

New graph types

In Baculum Web on graph page are available new graph types:

Support for new directives

New Director directives support:

New Storage Daemon directives support:

New File Daemon directives support:

New Console directives support:

Changes in API endpoints

Please note that in Baculum API have been changed endpoints with access to API panel and with access OAuth2 tokens. New endpoints are follow:

For backward compatibility previous panel and OAuth2 endpoints are still available, but they will be removed in the future.

Note For future versions Baculum API users, who use OAuth2 authorization and call API by own scripts, need to switch in theris scripts old OAuth2 endpoints to the new ones. Users, who install Baculum API from source archive, have to update the web server configuration to support new endpoints. Users, who install Baculum from binary packages, do not need to take any additional action.

Note Starting from version 9.6.0 there has been finished support for old API endpoints that do not contain version 'v1' in paths.

New API functions

In Baculum API are added the following new functions:

New Web controls

The Baculum Web are added new controls to support:

Miscellaneous improvements

Miscellaneous improvements in Baculum API and Baculum Web:

Base Features

Baculum provides the following base features:

To try Baculum features without installation, please visit the Baculum online demo page available at the following address:

https://baculum.app

General Requirements

Environment for Baculum Web installation should have following components installed:

Environment for Baculum API installation should have following components installed:

With installation from binary packages (deb, rpm) all requirements will be automatically installed as packages dependencies.

Installation Baculum API from rpm binary packages

Note Before start using Baculum API and Baculum Web version 9.0.0 and later please backup your Bacula configuration in safe place. It is specially important because on first save config action the Bacula configuration is joined into one file per Bacula component.

For rpm binary there are the following packages:

Add the Baculum rpm repository

To add the Baculum repository, first you must import the Baculum public key:

rpm --import http://bacula.org/downloads/baculum/baculum.pub

Once the key is imported, the next step is to add the repository definition. First you must create the following file:

/etc/yum.repos.d/baculum.repo

For CentOS 7 the baculum.repo file should have the following content:

[baculumrepo]
name=Baculum CentOS repository
baseurl=http://bacula.org/downloads/baculum/stable/centos
gpgcheck=1
enabled=1

For CentOS 8 the baculum.repo file should have the following content:

[baculumrepo]
name=Baculum CentOS repository
baseurl=http://bacula.org/downloads/baculum/stable/centos8
gpgcheck=1
enabled=1

For Fedora 31 the baculum.repo file should have the following content:

[baculumrepo]
name=Baculum Fedora repository
baseurl=http://bacula.org/downloads/baculum/stable/fedora
gpgcheck=1
enabled=1

Installation for Apache

Install Baculum API for the Apache web server as follows:

yum install baculum-common baculum-api baculum-api-httpd

Restart your Apache web server:

service httpd restart

Installation for Lighttpd

Installation on system with access via Lighttpd is as follows:

yum install baculum-common baculum-api baculum-api-lighttpd

Please note that in case CentOS distribution the Lighttpd web server is available in the distribution packages after enabling the EPEL repository.

Start Baculum API as application using the Lighttpd web server:

service baculum-api-lighttpd start

SELinux support

To enable Baculum API support for SELinux is needed to install the following binary package:

yum install baculum-api-selinux

Access to bconsole via sudo for Apache and Lighttpd

Baculum API requires access to Bconsole and to Bacula JSON programs. To configure Bconsole sudo access and the Bacula JSON programs access there can use following entries in newly created Baculum sudoers.d file (usually in path /etc/sudoers.d/baculum):

Note, please define sudo for the Bacula JSON programs only when you are going use Bacula configuration module in Baculum.

In case default Apache user, the file contents must be:

Defaults:apache !requiretty
apache  ALL=NOPASSWD:  /usr/sbin/bconsole
apache  ALL=NOPASSWD:  /usr/sbin/bdirjson
apache  ALL=NOPASSWD:  /usr/sbin/bsdjson
apache  ALL=NOPASSWD:  /usr/sbin/bfdjson
apache  ALL=NOPASSWD:  /usr/sbin/bbconsjson

In case default Lighttpd user the file contents must be:

Defaults:lighttpd !requiretty
lighttpd  ALL=NOPASSWD:  /usr/sbin/bconsole
lighttpd  ALL=NOPASSWD:  /usr/sbin/bdirjson
lighttpd  ALL=NOPASSWD:  /usr/sbin/bsdjson
lighttpd  ALL=NOPASSWD:  /usr/sbin/bfdjson
lighttpd  ALL=NOPASSWD:  /usr/sbin/bbconsjson

Installation Baculum API from deb binary packages

Note Before start using Baculum API and Baculum Web version 9.0.0 and later please backup your Bacula configuration in safe place. It is specially important because on first save config action the Bacula configuration is joined into one file per Bacula component.

For deb binary there are the following packages:

Add the Baculum deb repository

To add the Baculum repository, first import the Baculum public key:

wget -qO - http://bacula.org/downloads/baculum/baculum.pub | apt-key add -

Once the key is imported, the next step is to create a new baculum file:

/etc/apt/sources.list.d/baculum.list

For Debian 9 Stretch the baculum.list file should have the following content:

deb http://bacula.org/downloads/baculum/stable/debian stretch main
deb-src http://bacula.org/downloads/baculum/stable/debian stretch main

For Debian 10 Buster the baculum.list file should have the following content:

deb http://bacula.org/downloads/baculum/stable/debian buster main
deb-src http://bacula.org/downloads/baculum/stable/debian buster main

For Ubuntu 16.04 Xenial the baculum.list file should have the following content:

deb [ arch=amd64 ] http://bacula.org/downloads/baculum/stable/ubuntu xenial main
deb-src http://bacula.org/downloads/baculum/stable/ubuntu xenial main

For Ubuntu 18.04 Bionic the baculum.list file should have the following content:

deb [ arch=amd64 ] http://bacula.org/downloads/baculum/stable/ubuntu bionic main
deb-src http://bacula.org/downloads/baculum/stable/ubuntu bionic main

After adding repository definition, please refresh repository indexes:

apt-get update

Installation for Apache

To install Baculum API access via Apache web server by using apt packages manager use the command:

apt-get install baculum-common baculum-api baculum-api-apache2

Next you must enable mod_rewrite module for Apache, with the following command:

a2enmod rewrite

and include Baculum VirtualHost definition in the Apache configuration with:

a2ensite baculum-api

Then restart your Apache server with:

service apache2 restart

Installation for Lighttpd

Example installation with access via Lighttpd web server looks following:

apt-get install baculum-common baculum-api baculum-api-lighttpd

Start Baculum API as application available through Lighttpd web server:

service baculum-api-lighttpd start

Access to bconsole via sudo for Apache and Lighttpd

Baculum API requires access to Bconsole and to the Bacula JSON programs. To configure Bconsole sudo access, we strongly recommend that you create a Baculum sudoers.d file, which should be in /etc/sudoers.d/baculum:

Note, please define sudo for the Bacula JSON programs only when you are going use Bacula configuration module in Baculum.

Both for Apache and Lighttpd user the file contents can be:

Defaults:www-data !requiretty
www-data  ALL=NOPASSWD:  /usr/sbin/bconsole
www-data  ALL=NOPASSWD:  /usr/sbin/bdirjson
www-data  ALL=NOPASSWD:  /usr/sbin/bsdjson
www-data  ALL=NOPASSWD:  /usr/sbin/bfdjson
www-data  ALL=NOPASSWD:  /usr/sbin/bbconsjson

Debugging your First Baculum API Login

At each step of the initial login to Baculum, the screen will have a test button, that will allow you to check if your parameters were correctly entered. If not, you will see error message on the wizard page. You can also get additional detail by examining the Apache error log, that is usually found at:

/var/log/httpd/baculum-api-error.log

If you use Lighttpd thento get additional detail you can check:

/var/log/lighttpd/baculum-api-error.log

In addition, special debug output is placed by Baculum in the file:

/usr/share/baculum/htdocs/protected/API/Logs/baculum-api.log

The debug you can enable in file:

/usr/share/baculum/htdocs/protected/API/Config/api.conf

by switching in [api] section option debug to "1".

With the information in those two files, you can usually quickly find and correct most problems.

Installation Baculum Web from rpm binary packages

Installation for Apache

Install Baculum Web for the Apache web server as follows:

yum install baculum-common baculum-web baculum-web-httpd

Restart your Apache web server:

service httpd restart

Installation for Lighttpd

Installation on system with access via Lighttpd is as follows

yum install baculum-common baculum-web baculum-web-lighttpd

Please note that in case CentOS distribution the Lighttpd web server is available in the distribution packages after enabling the EPEL repository.

Start Baculum as application using the Lighttpd web server:

service baculum-web-lighttpd start

SELinux support

To enable Baculum Web support for SELinux is needed to install the following binary package:

yum install baculum-web-selinux

Installation Baculum Web from deb binary packages

Installation for Apache

To install Baculum Web access via Apache web server by using apt packages manager use the command:

apt-get install baculum-common baculum-web baculum-web-apache2

Next you must enable mod_rewrite module for Apache, with the following command:

a2enmod rewrite

and include Baculum VirtualHost definition in the Apache configuration with:

a2ensite baculum-web

The restart your Apache server with:

service apache2 restart

Installation for Lighttpd

Example installation with access via Lighttpd web server looks following:

apt-get install baculum-common baculum-web baculum-web-lighttpd

Start Baculum Web as application available through Lighttpd web server:

service baculum-web-lighttpd start

Running Baculum API and Web for the First Time

Running Baculum API

Access to Baculum API from web browser: http://localhost:9096

First time login: admin

First time password: admin

Running Baculum Web

Access to Baculum Web from web browser: http://localhost:9095

First time login: admin

First time password: admin

Installation wizards

Installation with HTTP Basic authentication

Image baculum_install_basic

Installation with OAuth2 authorization

Image baculum_install_oauth2

Configuring Bacula

During first use the Bacula configuration feature when 'Save' button is clicked, there can be visible an permission error similar to this error:

Error 1000: Internal error.
[Warning] file_put_contents(/etc/bacula/bacula-dir.conf): failed to open stream:
Permission denied (@line 56 in file
/usr/share/baculum/htdocs/protected/Common/Class/ConfigBacula.php).

It means that the Baculum API web server user does not have permission to write Bacula configuration file. To solve it, please setup permissions for Bacula configuration files to allow web server user have write access.

Current Baculum API documentation

The most actual Baculum API documentation is placed at the following address:

https://bacula.org/downloads/baculum/baculum-api/

Installation from the source tar file

There is possible to install Baculum from the source bacula-gui tar archive. To install please unpack the bacula-gui source archive and go to this unpacked directory:

cd bacula-gui-9.6.0/baculum/

Then please prepare the Baculum API and the Baculum Web files depending on used distribution in the way described below.

In this description the document root directory for web files is path: /var/www/baculum. This location can be changed during installation in the WWWDIR parameter value.

Manual installation on rpm-based Linux distributions

To prepare all Baculum files to installation please execute from the source files path the following command:

make build DESTDIR=/tmp/baculum-files WWWDIR=/var/www/baculum

After executing above command, the directory /tmp/baculum-files should contain all required files ready to copy to destination system paths.

Install the Baculum API and the Baculum Web dependencies:

yum install httpd php php-common php-pdo php-mysqlnd php-pgsql php-bcmath php-json php-xml

Copy to the destination path all Baculum web type files:

cp -R /tmp/baculum-files/var/www/baculum/ /var/www

Copy the web server configuration files:

cp /tmp/baculum-files/etc/httpd/conf.d/baculum-*conf /etc/httpd/conf.d/

Copy the HTTP Basic authentication files:

cp /tmp/baculum-files/etc/baculum/Config-api-apache/baculum.users /var/www/baculum/protected/API/Config
cp /tmp/baculum-files/etc/baculum/Config-web-apache/baculum.users /var/www/baculum/protected/Web/Config

Copy translation files:

cp --remove-destination /tmp/baculum-files/usr/share/locale/en/LC_MESSAGES/baculum-api.mo /var/www/baculum/protected/API/Lang/en/messages.mo
cp --remove-destination /tmp/baculum-files/usr/share/locale/pl/LC_MESSAGES/baculum-api.mo /var/www/baculum/protected/API/Lang/pl/messages.mo
cp --remove-destination /tmp/baculum-files/usr/share/locale/pt/LC_MESSAGES/baculum-api.mo /var/www/baculum/protected/API/Lang/pt/messages.mo
cp --remove-destination /tmp/baculum-files/usr/share/locale/en/LC_MESSAGES/baculum-web.mo /var/www/baculum/protected/Web/Lang/en/messages.mo
cp --remove-destination /tmp/baculum-files/usr/share/locale/pl/LC_MESSAGES/baculum-web.mo /var/www/baculum/protected/Web/Lang/pl/messages.mo
cp --remove-destination /tmp/baculum-files/usr/share/locale/pt/LC_MESSAGES/baculum-web.mo /var/www/baculum/protected/Web/Lang/pt/messages.mo
cp --remove-destination /tmp/baculum-files/usr/share/locale/ja/LC_MESSAGES/baculum-web.mo /var/www/baculum/protected/Web/Lang/ja/messages.mo

Set recursively owner and group for files and directories:

chown -R apache:apache /var/www/baculum

Prepare and install the SELinux module (if SELinux is used in operating system):

yum install selinux-policy-devel

make -C examples/selinux/ -f /usr/share/selinux/devel/Makefile baculum-api.pp
make -C examples/selinux/ -f /usr/share/selinux/devel/Makefile baculum-web.pp
install -D -m 644 examples/selinux/baculum-api.pp /usr/share/selinux/packages/baculum-api/baculum-api.pp
install -D -m 644 examples/selinux/baculum-web.pp /usr/share/selinux/packages/baculum-web/baculum-web.pp
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/baculum/protected/API/Config(/.*)?'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/baculum/protected/API/Logs(/.*)?'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/baculum/protected/Web/Config(/.*)?'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/baculum/protected/Web/Logs(/.*)?'
semanage fcontext -a -t httpd_cache_t '/var/www/baculum/assets(/.*)?'
semanage fcontext -a -t httpd_cache_t '/var/www/baculum/protected/runtime(/.*)?'
restorecon -i -R '/var/www/baculum/protected/API/Config' '/var/www/baculum/protected/API/Logs' '/var/www/baculum/protected/Web/Config' '/var/www/baculum/protected/Web/Logs' '/var/www/baculum/assets' '/var/www/baculum/protected/runtime'
semodule -i /usr/share/selinux/packages/baculum-api/baculum-api.pp
semodule -i /usr/share/selinux/packages/baculum-web/baculum-web.pp

Start the Apache web server

systemctl start httpd

Manual installation on deb-based Linux distributions

To prepare all Baculum files to installation please execute from the source files path the following command:

make build DESTDIR=/tmp/baculum-files SAMPLETYPE=deb-template HTTPDNAME=apache2 HTTPDSITECONF=sites-available WWWDIR=/var/www/baculum

After executing above command, the directory /tmp/baculum-files should contain all required files ready to copy to destination system paths.

Install the Baculum Web and the Baculum API dependencies:

apt-get install apache2 libapache2-mod-php php-bcmath php-cgi php-mysql php-pgsql php-json php-xml php-curl

Copy to the destination path all Baculum web type files:

cp -R /tmp/baculum-files/var/www/baculum/ /var/www

Copy the web server configuration files:

cp /tmp/baculum-files/etc/apache2/sites-available/baculum-*conf /etc/apache2/sites-available/

Copy the HTTP Basic authentication files:

cp /tmp/baculum-files/etc/baculum/Config-api-apache/baculum.users /var/www/baculum/protected/API/Config
cp /tmp/baculum-files/etc/baculum/Config-web-apache/baculum.users /var/www/baculum/protected/Web/Config

Copy translation files:

cp --remove-destination /tmp/baculum-files/usr/share/locale/en/LC_MESSAGES/baculum-api.mo /var/www/baculum/protected/API/Lang/en/messages.mo
cp --remove-destination /tmp/baculum-files/usr/share/locale/pl/LC_MESSAGES/baculum-api.mo /var/www/baculum/protected/API/Lang/pl/messages.mo
cp --remove-destination /tmp/baculum-files/usr/share/locale/pt/LC_MESSAGES/baculum-api.mo /var/www/baculum/protected/API/Lang/pt/messages.mo
cp --remove-destination /tmp/baculum-files/usr/share/locale/en/LC_MESSAGES/baculum-web.mo /var/www/baculum/protected/Web/Lang/en/messages.mo
cp --remove-destination /tmp/baculum-files/usr/share/locale/pl/LC_MESSAGES/baculum-web.mo /var/www/baculum/protected/Web/Lang/pl/messages.mo
cp --remove-destination /tmp/baculum-files/usr/share/locale/pt/LC_MESSAGES/baculum-web.mo /var/www/baculum/protected/Web/Lang/pt/messages.mo
cp --remove-destination /tmp/baculum-files/usr/share/locale/ja/LC_MESSAGES/baculum-web.mo /var/www/baculum/protected/Web/Lang/ja/messages.mo

Set recursively owner and group for files and directories:

chown -R www-data:www-data /var/www/baculum

Enable the web server Baculum API and Baculum Web sites:

a2ensite baculum-api
a2ensite baculum-web

Enable the URL rewrite module for the Apache web server:

a2enmod rewrite

Start the Apache web server

systemctl start apache2

Validating manual installation

To check manually installed the Baculum API and the Baculum Web files please use a script, which checks whether files and directories exist in proper paths, if they have set valid permissions, ownership and other requirements.

To check files for installation with Apache web server:

/tmp/baculum-files/baculum-install-checker.sh -a

To check files for installation with Lighttpd web server:

/tmp/baculum-files/baculum-install-checker.sh -l

OAuth2 authorization

In Baculum API you can setup OAuth2 for authorization and authentication.

To get an access token there is used Authorization Code Grant flow. Authorization and access token URLs are as follow:

Authorization URL: /oauth/authorize
Access Token URL: /oauth/token

Baculum API does not use refresh tokens. After expiration token the client application has to re-authorize again.

Default expiration time for authorization code is 7 seconds, for access token 60 seconds. These values can be changed in:

/usr/share/baculum/htdocs/protected/Common/Class/OAuth2.php

in constants AUTHORIZATION_ID_EXPIRES_TIME and ACCESS_TOKEN_EXPIRES_TIME.

Default OAuth2 callback URL in Baculum Web is following:

https://baculumgui:9095/web/redirect

Before running OAuth2

Important note before using OAuth2

When you decide to use OAuth2, you must change default HTTP Basic authentication setting. Otherwise OAuth2 will not work. It is all about enabling OAuth2 acces to /api/ endpoints but still keeping the HTTP Basic protection for the Baculum API panel pages.

For Apache this change consists in replacing in the Baculum API Apache config the Directory tag /usr/share/baculum/htdocs into Location tag /panel

#
# NOTE: When you use OAuth2 then change this Directory section
# From: <Directory /usr/share/baculum/htdocs>
#            ...section body...
#       </Directory>
# To:   <Location /panel>
#            ...section body...
#       </Location>
#
<Directory /usr/share/baculum/htdocs>
#<Location /panel>
        AuthType Basic
        AuthName "Baculum Auth"
        AuthUserFile /usr/share/baculum/htdocs/protected/API/Config/baculum.users
        Require valid-user
#</Location>
</Directory>

For Lighttpd this change consists in uncommenting in the Baculum API Lighttpd config lines as shown in the comment below.

#
# Uncomment this line and closing braces below when you use OAuth2
#
#$HTTP["url"] =~ "^/panel.*$" {
        auth.backend = "htpasswd"
        auth.backend.htpasswd.userfile = "/usr/share/baculum/htdocs/protected/API/Config/baculum.users"
        auth.require = ( "/" => (
                "method" => "basic",
                "realm" => "Baculum Auth",
                "require" => "valid-user"
                )
        )
#}

Multi-user interface

Baculum enables access to Bacula resources for defined users, where every user uses own resources (Jobs, Clients, FileSets ...etc.). These resources are assigned to users by the Bacula Restricted Consoles and then they are used by Baculum.

To setup this multi-user interface there is needed to enable the OAuth2 authorization on Baculum API hosts, that are used by the Baculum Web interface. There is also necessarily to define in the Director configuration Console resources for users and dedicated for them Bconsole config files.

Minimal Console resource configuration can look as below. These CommandAcl values in the configuration are required to proper working all available functions for normal Baculum users (run job, restore backup, cancel job, delete job and others).

Console {
  Name = "Limited User 144"
  Password = "A6cTimESfLs7xPNOMC/ein92BF4="
  JobAcl = "BackupCatalog"
  JobAcl = "RestoreFiles"
  ClientAcl = "myhost-fd"
  StorageAcl = "File1"
  PoolAcl = "File"
  CommandAcl = "gui"
  CommandAcl = ".api"
  CommandAcl = ".jobs"
  CommandAcl = ".ls"
  CommandAcl = ".client"
  CommandAcl = ".fileset"
  CommandAcl = ".pool"
  CommandAcl = ".status"
  CommandAcl = ".storage"
  CommandAcl = ".bvfs_get_jobids"
  CommandAcl = ".bvfs_update"
  CommandAcl = ".bvfs_lsdirs"
  CommandAcl = ".bvfs_lsfiles"
  CommandAcl = ".bvfs_versions"
  CommandAcl = ".bvfs_restore"
  CommandAcl = ".bvfs_cleanup"
  CommandAcl = "restore"
  CommandAcl = "show"
  CommandAcl = "estimate"
  CommandAcl = "run"
  CommandAcl = "delete"
  CommandAcl = "cancel"
  FilesetAcl = "Full Set"
  CatalogAcl = "MyCatalog"
  WhereAcl = "/tmp/restore"
}

Assigning Restricted Consoles to users is realized during configuring OAuth2 accounts on API hosts panel as on attached screenshot.

Image baculum_add_oauth2_user_account

Please note that in the OAuth2 scopes there is not "config" scope defined, because normal users don't have access to configuring Bacula resources by Baculum API hosts.

Once the OAuth2 accounts with assigned dedicated consoles are done, now you can connect Baculum Web to those new Baculum API OAuth2 accounts.

Image baculum_add_new_api_host

At the end there is needed to create Baculum Web users and assign them to appropriate OAuth2 user accounts on API hosts.

Image baculum_define_and_assign_users_to_api_hosts

Images below show difference between access to Baculum API hosts and to resources by normal users and by admin user.

Image baculum_multi_user_admin_mode

Image baculum_multi_user_user_mode

Normal (non-admin) user interface can look as on screenshot:

Image baculum_normal_user_dashboard

Multi-user interface setup in steps

Below you can find list with steps needed to setup the Baculum multi-user interface:

  1. Install Baculum API.
  2. Change the Baculum API web server config file to support OAuth2 and restart the web server.
  3. Go to the Baculum API installation wizard and fill needed forms on wizard steps.
  4. In "Authentication" step please select OAuth2 authorization option and define there administrator OAuth2 client account. It is an account without any dedicated Bconsole config file path (full bconsole access) and with all scopes.
  5. Finish the Baculum API wizard.
  6. Install Baculum Web. Go to the installation wizard and fill forms on each wizard step.
  7. In the "Add API host" step please select OAuth2 authorization option and please provide the administrator OAuth2 account parameters defined previously in the Baculum API installation wizard.
  8. Finish the Baculum Web wizard.
  9. Define in the Bacula Director configuration dedicated Consoles for users. You can do it in Baculum on manually in Director configuration file. At the end please reload the Director configuration.
  10. In Baculum API panel on the "List OAuth2 clients" tab create new OAuth2 client accounts, each account for separate user or group of users. For each OAuth2 account in field "Dedicated Bconsole config file path" define separate Bconsole config file with access only to selected restricted console (the bconsole configuration files must be prepared manually before this step). In scopes field please be careful to not set "config" or "actions" scopes to regular user if it isn't your intention.
  11. In Baculum Web on the "Configure" page please click "Add API host" button and add there created in previous point all OAuth2 client accounts.
  12. Go to "Users" page, create new users and assign API hosts to them.

Screenshots

Image baculum01

Image baculum02

Image baculum03

Image baculum04

Image baculum05

Image baculum06

Image baculum07

Image baculum08

Image baculum09