orphanAgentUser capabilities

[D4V3M0NK]

I see with some interest a newer (?) configuration option orphanAgentUser which, according to the config, states that any agent that connects to the server and doesn't have an assigned group, will be available to the configured user.

If an agent attempts to connect to a unknown device group, automatically create a new device group and grant access to the specified user.

I've ran some tests with this and would like to share the results, in the hope that perhaps I may have discovered a slight issue.

1. Server1 has my remote configured and working perfectly.
2. I set up a brand new Server2 and create a group (S2G1, that being "Server 2 Group 1") . Server2 is configured for orphanAgentUser set to my (admin) account
3. I have a migration script installed on my remote that is configured to move itself from Server1 to Server2. I invoke that script.
   1. It's worth noting at this point, that my script has the URL of the new server AND the ID of the S2G1 group
4. The migration works without issue, my remote appears in my S2G1 group

So far, so good.

5. I now shut down my remote, and delete S2G1
6. I create S2G2
7. I turn on my remote

At this point, I would've expected the remote to be placed into the S2G2 group or, if no groups are created, perhaps create a new group, owned by me, called Orphans (or something similar). It doesn't appear that this is the case though. Even if I recreate "S2G1", the remote doesn't join that group (it would've been created with a new ID of course, which is to be expected).

Note orphanAgentGroup may be a useful addition to the configuration so that any agents connecting to the server are automatically placed in this group

I see that the remote's meshagent.msh has, at the top of it's file:

MeshName=Group1
MeshType=2
...

It appears that MC2 will only allocate a group to an orphaned remote (owned by the configured user) one time. Is that the idea here? You only get one shot at a remote being an orphan? Or am I missing something here?

I think the usefulness of this is incredibly smart - if someone mistakenly deletes a group on the server itself, you don't lose access to the remotes. However in practice, it appears that the functionality differs slightly?

(Both servers are set up to use MySQL as the backend DB, if that's of any interest)

[D4V3M0NK]

Ok - am eating my own words here now ... it appears that (after some time) a new group (called Group1) is actually created on the server and the remote is placed inside of it. I'm surmising that the group name is infact the same name of the group that the remote was originally connecting to ...

Apologies for the extended question... keeping this here simply for prosperity's sake

[si458]

Are u using sessionrecording? As the is a bug with sessionrecording enabled where new agents don't get created/added, only existing ones work

[D4V3M0NK]

No Simon, no session recording enabled