on - edited on by
MaciejNeumann
Summary
This process can be applied to all Platform Documents (Dashboards, Notebooks, Launchpads), and will allow said Document to have a new Owner, and optionally be made public so that all users in the Environment can view it.
Problem
Sometimes a Document is kept in private only access (which is default), and then the owner of the Document no longer has access (Left the company, changed roles, etc...). This blocks other users from accessing the Document, making modifications, or changing its sharing settings. The Document's ownership can be transferred using the Document Service API.
Troubleshooting steps
- There is a Dynatrace Document which is in the default private only setup which end users need access to.
- This can be a Platform Dashboard, Notebook, or Launchpad.
- Ownership of the Document needs to be transferred to a new user account.
Resolution
The overall process is documented in our Developer Site. We need to use the transfer-owner API call with admin-access: true. As part of this, an OAuth2 Client will be made.
- Ensure the User Account which is making the OAuth2 Client has the "Admin User" Policy assigned, or an equivalent that allows for the following IAM Policies. Create a policy - assign a policy to a group - assign users to groups
-
ALLOW document:documents:read, document:documents:write, document:documents:delete, document:documents:admin
-
- Create an OAuth2 Client using the User Account from Step 1 as the subject email with the following 4 permissions checked.
- Make sure to copy the Client ID, Client secret, and Dynatrace account URN.
- Within the SaaS Environment, create a test Dashboard so the user ID of the new owner can be found. Remember this Dashboard name.
- Execute the following cURL to generate our Bearer/Access Token - Request a token
-
curl -L -X POST 'https://sso.dynatrace.com/sso/oauth2/token' -H 'Content-Type: application/x-www-form-urlencoded' -d 'grant_type=client_credentials' -d 'client_id={Client-id}' -d 'client_secret={Client-secret}' -d 'resource={Dynatrace-account-urn}' -d 'scope=document:documents:read document:documents:admin document:documents:write' - Replace {Client-id}, {Client-secret}, and {Dynatrace-account-urn} with the details from Step 2.
- Copy the Base64 token from the access_token field. This token is valid for 5 minutes. Resubmit this API Call if our token expires.
-
- Find the owner ID we want to transfer ownership to, as well as the ID of the Dashboard needing its ownership transferred.
- Execute the following cURL, replacing {SaaS-Tenant-URL} and {your-access-token} with the relevant data.
-
curl -X 'GET' \
'https://{SaaS-Tenant-URL}/platform/document/v1/documents?admin-access=true' \
-H 'accept: application/json' \
-H 'Authorization: Bearer {your-access-token}' - For the Test Dashboard from Step 3, keep track of the ID found within the owner field. This will be the {new-owner-id} in the next step.
- For the Document needing ownership transferred, keep track of the ID found within the id field. This will be the {id-of-document} in the next step.
- Execute the transfer-owner API call.
-
curl -X 'POST' \
'https://{SaaS-Tenant-URL}/platform/document/v1/documents/{id-of-document}:transfer-owner?admin-access=true' \
-H 'accept: */*' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer {your-access-token}' \
-d '{
"newOwnerId": "{new-owner-id}"
}' - Replace {SaaS-Tenant-URL}, {your-access-token} {id-of-document}, and {new-owner-id} with the relevant details.
-
The ownership of the Document which was targeted should now be transferred to the new owner, at which point they can configure the sharing settings to make it public, or make modifications to the Document as if they had made it originally.
What's next
If this article did not help, please open a support ticket, mention that this article was used and provide the following in the ticket:
