Post bootstrap re-assignment of devices

[dberardo-com]

hi there,

i would like to implement this flow:

1. a device register to openwisp server using a common secret into the "Generic" organization
2. the openwisp server recognizes that the device belongs to another organization and migrates it there, so that new organization specific templates are loaded

is this something that can be already implemented in openwisp or does it require a custom flow ?

[nemesifier]

Step 1 is supported: devices can register using the shared secret of a generic organization.

Step 2 requires a routing rule defined by the deployment. OpenWISP cannot infer the intended organization when every device registers with the same shared secret. If you can express an internal rule that distinguishes devices, you can implement it with a receiver for the device_registered signal.

The following example routes a newly registered device from the generic organization to organization 2 when its MAC address starts with 00:11:22, otherwise to organization 3. Replace the UUIDs and MAC prefix with the values and rule used in your deployment.

# organization_routing.py
from uuid import UUID

from django.db import transaction
from django.dispatch import receiver
from swapper import load_model

from openwisp_controller.config.signals import device_registered


GENERIC_ORGANIZATION_ID = UUID("11111111-1111-1111-1111-111111111111")
ORGANIZATION_2_ID = UUID("22222222-2222-2222-2222-222222222222")
ORGANIZATION_3_ID = UUID("33333333-3333-3333-3333-333333333333")


@receiver(
    device_registered,
    dispatch_uid="organization_routing.route_registered_device",
)
def route_registered_device(sender, instance, is_new, **kwargs):
    if not is_new or instance.organization_id != GENERIC_ORGANIZATION_ID:
        return

    destination_id = (
        ORGANIZATION_2_ID
        if instance.mac_address.startswith("00:11:22")
        else ORGANIZATION_3_ID
    )
    Organization = load_model("openwisp_users", "Organization")
    destination = Organization.objects.get(pk=destination_id)

    with transaction.atomic():
        instance.organization = destination
        # A group belonging to the generic organization cannot be retained.
        instance.group = None
        instance.full_clean()
        instance.save()

        config = instance.config
        config.device.organization = destination
        config.templates.clear()
        config.add_default_templates()

The receiver runs only for new registrations. It removes templates inherited from the generic organization, re-adds required templates for the destination organization, and adds its default templates.

With ansible-openwisp2, add the receiver file to the generated Django project and import it through openwisp2_extra_django_settings_instructions:

- hosts: openwisp
  vars:
    openwisp2_extra_django_settings_instructions:
      - "from .organization_routing import route_registered_device"

  roles:
    - role: openwisp.openwisp2

  tasks:
    - name: Deploy organization-routing receiver
      ansible.builtin.copy:
        src: files/organization_routing.py
        dest: "{{ openwisp2_path }}/openwisp2/organization_routing.py"
        group: "{{ www_group }}"
        mode: "0640"
      notify: Reload application

Put the receiver code in files/organization_routing.py. The role writes the additional instruction to the generated settings.py, so Django imports the receiver during startup and connects it to device_registered.

With docker-openwisp, place the receiver in:

customization/configuration/django/organization_routing.py

Then import it from customization/configuration/django/custom_django_settings.py:

from .organization_routing import route_registered_device

Recreate the application containers after adding the customization:

docker compose up -d --force-recreate dashboard api

If no reliable rule can be defined, the fallback is to leave the device in the generic organization after registration and manually move it to the correct organization in the dashboard, then assign the appropriate templates.

[dberardo-com]

thanks a lot for the answer. i ended up implementing something similar, in my particular case i define a Metadata JSON schema for device groups.

every group (organization) can implement a list of MAC/hardware ids and the controller will then check he newly registered device's MAC against the one from all organization's lists (duplicates will lead to errors, so human assignment will be needed).

then the device will be assigned to that group and removed from the generic organization.

the group then birngs in all required templates.

now i am trying to assign subnets for the specific organizations from a shared pool, but with limited subnets (say the master subnet is a /16 and the organization's ones are /24).

i was having issues with vpn subnets so i had to switch back to device subnets, but probably i will be getting it to work.

P.S. my deployment is an Helm (kubernetes) based one, not ansible.