GLPI connector

The GLPI connector feeds the Portail ZAPP CMDB with the computers, network equipment, printers, monitors, peripherals and phones managed in GLPI (versions 10 and 11). Portail ZAPP calls the GLPI REST API, directly from its server or, when GLPI cannot be reached from it, through an Outpost agent installed on the GLPI network (see "Closed GLPI: Outpost mode"). The screens are restricted to administrators; the GLPI entry is in the Administration › Connectors and automation menu.

The connector never changes GLPI: it only reads.

What is imported

On each collection, the connector reads the GLPI computers and creates or updates one Computer per machine in the CMDB, with:

its name, domain, serial number and UUID;
its operating system and version;
its processor and memory (sum of the modules);
its disks (name, size, free space), network ports (name, MAC address, IP address) and installed software (name, version, publisher, installation date), depending on the components chosen for the source.

GLPI computer templates are never imported. Objects in the GLPI trash are only imported if the source asks for it.

If the source asks for it (Imported GLPI objects), the connector also reads:

network equipment: one Network device per item in the CMDB, with its name, serial number, device type (Switch, Router, Firewall… when the GLPI type matches one of them), manufacturer, model, firmware and location; with network ports, its ports (MAC and IP address) and its IP address;
network printers: a Network device of type Printer, with the same information. A printer without a network address (USB) becomes a Printer, matched by its serial number;
monitors, peripherals and phones: a Monitor, a Peripheral or a Mobile device, with name, serial number, brand, model, status and purchase information. They are matched by their serial number only, never by name: an item without a serial number gets its own record;
connections: when computers are imported, the items GLPI connects to them ("Connections" tab) are linked to the computer in the CMDB ("connected to"). A connection removed in GLPI is removed at the next full collection; a link you added by hand is never removed.

A device already found by the network inventory is not duplicated: it is matched by its serial number, MAC addresses or name.

Depending on the GLPI fields chosen for the source (see below), the connector also imports the status, manufacturer, model, purchase and warranty end dates, purchase cost, and any other GLPI or Fields plugin field linked to a CMDB field. If the source asks for it, each computer is also linked to its location in the CMDB based on its GLPI location (see "Computer location"). If the source also asks for it, each computer's GLPI user and technician are matched with a Portail ZAPP account (see "Computer users").

A known computer is not duplicated: if another source (Ivanti UEM, Intune…) already imported it, it is matched by its UUID, serial number, MAC addresses or name, and its fields are completed. The generic serial numbers GLPI often holds ("To Be Filled By O.E.M.", "Default string", "0", "System Serial Number"…) and all-zero UUIDs are ignored for matching: two different machines are never merged on a fake serial number.

Before creating a source

In GLPI, an administrator prepares the access:

Enable the REST API: Setup › General › API, tick "Enable REST API" and "Enable login with external token".
Create an API client on the same screen: active, with no address restriction or with the address of the Portail ZAPP server, then regenerate its application token (App-Token).
Create a read-only profile: clone the Read-Only profile and remove its read access to General setup. The connector needs no write right.
Create a dedicated user with this profile on the root entity, recursive. In its Remote access keys tab, tick Regenerate next to the API token, then Save: the token only exists once saved.

In Portail ZAPP, store both tokens in the Secrets vault: the source names each token by its secret name, never by its value.

HTTP or HTTPS

Prefer an https:// address. Over HTTPS, the GLPI certificate must be trusted by the Portail ZAPP server: a GLPI whose certificate is issued by an internal authority requires that authority to be trusted on that server. There is no option to ignore a certificate error.

An http:// address is only accepted when Allow unencrypted HTTP is ticked: the GLPI tokens then travel in clear text on the network. The source page shows it permanently.

For security reasons, an address of the machine itself (localhost, 127.0.0.1) or a cloud provider metadata address is always refused. Private network addresses are accepted. GLPI cannot redirect the connector to another server.

Closed GLPI: Outpost mode

If the Portail ZAPP server cannot reach GLPI (for example Portail ZAPP hosted online and GLPI on your internal network), pick a machine group in GLPI access: an Outpost agent of that group reads GLPI instead of the server. At least one agent must be active, in version 0.5.7 or later, and able to reach GLPI itself.

A single agent of the group works on each collection: the first compatible active agent.
If that agent is stopped, the request fails for lack of reply (AgentNoReply); the synchronization runs at the next scheduled execution, once the machine is back.
Over HTTPS, the agent's machine checks the GLPI certificate: the authority that issued it must be trusted there, and the GLPI name must resolve there.
The tokens are sent to it for the duration of the read; they are never stored on the machine.
The timeout applies to each request made to the agent, at most 300 seconds.
Test connection, GLPI fields and the collection work the same way in both modes; in Outpost mode, the connection test and the field discovery name the agent that replied.
The GLPI access column of the source list shows how each source reads GLPI: "Direct" or "Outpost ·

Without the Outpost module, the list is greyed out and only direct mode is possible.

Creating a source

The GLPI sources page lists the sources with their address, schedule and state. Click + New source and fill in:

Name and Slug (short identifier, no spaces; it can no longer be changed after creation);
GLPI REST API URL: the address of apirest.php, or the GLPI root (apirest.php is appended);
Allow unencrypted HTTP: only for an http:// address;
GLPI access: Direct mode (default), or an Outpost machine group when GLPI cannot be reached from the server (see "Closed GLPI: Outpost mode");
Secret: application token (App-Token) and Secret: user API token (user_token): choose the secrets in the lists. If they are empty, the create one link opens the secrets vault;
Call timeout: from 5 to 600 seconds (60 by default);
Imported GLPI objects: computers, network equipment, printers, monitors, peripherals, phones. Only computers are ticked by default;
Also import objects from the GLPI trash: unticked by default;
Imported components: disks, network ports, installed software, all ticked by default. Software takes the longest to read: unticking it makes collecting a large fleet much faster. If the GLPI profile cannot read network equipment, network ports are not imported (computers still are);
Link computers to their location: unticked by default (see "Computer location");
Match GLPI users with user accounts and the order of the keys: unticked by default (see "Computer users");
Link CMDB contacts to computers: unticked by default (see "Reconciling users by hand");
Schedule (cron, optional): the collection frequency, chosen with the wizard. Without a schedule, the source only synchronizes through "Synchronize now".

Click Save: the source page opens.

Testing the connection

On the source page, Test connection opens a GLPI session with both tokens, shows the GLPI version, then closes the session. Nothing is imported or saved. On failure, a message gives the cause (see the table below).

Synchronize now

Synchronize now (in the list or on the source page) starts a collection in the background: the screen returns at once. One collection at a time per source: a second click during a collection is refused. A disabled source does not synchronize.

To be fast, a collection only reads the objects modified in GLPI since the last successful collection. It reads all objects:

if you tick Full collection next to "Synchronize now" on the source page;
if no collection has succeeded for 7 days;
after a change that requires it (GLPI fields, component ticked again, object type added, trash, GLPI address): the source page then shows "The next collection will be a full one" and the box is already ticked.

GLPI does not always flag a computer as changed when only its software changed: such a change is then picked up at the latest by the weekly full collection, or at once with Full collection.

The Last collection panel of the source page shows its status, start and end times, the number of imported objects and of errors. Reload the page to follow a running collection. It also shows the Mode of that collection ("Direct" or "Outpost ·

Computer location

With the Link computers to their location option, each computer's GLPI location (its full path, for example "Head office > Building A > Room 101") is matched with a CMDB location of the same path, ignoring case and accents. The computer is then associated with that location; any other location it had is replaced.

A location that does not exist yet is created, with its missing parents; existing parents are reused.
A computer without a location in GLPI keeps its location.
If several CMDB locations have the same path, the location is ambiguous: the computer is not linked, and the location is listed in the Last collection panel. Rename one of the locations to remove the ambiguity.
A location change in GLPI is picked up at the next collection.
Only computers are linked; network equipment keeps its location as text.

Computer users

With the Match GLPI users with user accounts option, a computer's GLPI user becomes its primary user in the CMDB, and the technician in charge its owner. Each GLPI user is matched with a Portail ZAPP account through keys tried in the chosen order (Key 1 to Key 3); the first one that points to a single account wins:

AD directory identifier: when GLPI synchronizes Active Directory through the objectGUID identifier, that identifier is looked up among the accounts synchronized by AdSync;
Login: the GLPI login is looked up among Portail ZAPP logins, ignoring case;
Email address: each address of the GLPI user is looked up, ignoring case and accents.

A key that points to several accounts (two accounts with the same address, for example) moves on to the next one. A deleted account is never used; a disabled account is.

No user account is created.
A user without a match leaves the field unchanged: it is never cleared.
The Last collection panel counts the matched users and lists those that were not matched, with the reason ("No account" or "Several accounts") and the number of computers involved.
When Intune also provides a machine's primary user, Intune wins.

Reconciling users by hand

The Reconcile users button of the source page opens the list of GLPI users designated by the computers: the To process tab shows those the keys did not match, the All tab shows everyone. For each one: login, name, addresses, number of computers, result of the automatic matching and decision taken.

Link to an account: search for the account by name, login or address (ignoring case and accents), then Link.
Create the contacts: for a person without an account, tick them, choose their third party and create the contact; it is prefilled with their name and address.
Ignore: the user is no longer offered nor counted as unmatched.
Remove the decision: the user goes back through the keys.

The checkboxes let you process several users at once. A decision takes precedence over the keys and applies at the next collection, which will be full: run Synchronize now to apply it right away. A user linked to a contact fills neither the primary user nor the owner; with the Link CMDB contacts to computers option, their computers are linked to the contact ("used by" for the user, "managed by" for the technician).

Collection result

The Last collection panel shows one of these statuses:

Success: all objects were imported;
Partial success: some objects could not be processed; the others are imported normally;
Error: the collection imported nothing; the cause is given by a code:

Code	Meaning
`AuthenticationFailed`	GLPI refuses the application token or the user API token
`Forbidden`	The user's GLPI profile cannot read computers
`ApiDisabled`	The REST API is disabled in GLPI
`GlpiUnavailable`	GLPI unreachable, timeout, refused redirection or unreadable response
`Throttled`	GLPI limits the number of calls; the next collection will retry
`InsecureHttpRefused`	http:// address without the "Allow unencrypted HTTP" option
`SecretResolutionFailed`	One of the named secrets is missing or unreadable
`SecretResolutionUnavailable`	The secrets vault is not installed
`InvalidConfig`	The source is incomplete: edit it
`AllItemsFailed`	No object could be processed
`AlreadyRunning`	A collection of this source is already running
`InvalidMappings`	Two active mappings target the same CMDB field
`CmdbFieldAdminRequired`	Creating a CMDB field requires the right to add fields to CMDB types
`OutpostUnavailable`	Outpost mode: the Outpost module is not installed
`NoCompatibleAgent`	Outpost mode: no active, GLPI-capable agent in the machine group
`AgentNoReply`	Outpost mode: the agent did not reply in time
`UnsupportedAgentVersion`	Outpost mode: the agent is too old; update it
`ResultTooLarge`	Outpost mode: a GLPI object is too large to be sent by the agent
`AgentError`	Outpost mode: the agent rejected the request or failed

Each source also has a task in the Scheduler (Administration › Instance and operations › Scheduler), named Connector.Glpi: followed by the source identifier, with its Execution history.

GLPI fields

On the source page, Manage fields opens the GLPI fields page. A badge on the source page flags fields that appeared in GLPI since your last discovery.

Mappings. The table links each GLPI field to a CMDB field; its rows are grouped by GLPI object type (a type the source does not import is flagged "Type not collected"). For each row, you can:

disable it (Active box) or remove it (Remove box);
choose the target CMDB field;
choose a transform: none, trim spaces, number, date, or value map (one GLPI value = CMDB value line per value);
for a choice list, decide what to do with a value that is not a known choice: ignore it or add the choice.

Click Save. Each row's status tells whether it will be applied: only valid rows are, and a collection never creates a field. Name, serial number and UUID always stay active: they identify the machines. Restore default mappings brings back the original configuration.

Discover fields. This button reads GLPI's field list and a sample of 50 objects of each imported type, without changing anything. For each field, the page shows sample values, its state (mapped, dismissed, new), and suggests a CMDB field slug and type. Check the fields you want, then:

Create or map the selection: for each checked field, keep "create a new field" to add the suggested field to the CMDB Computer type (or Network device for a network equipment or printer field, Monitor, Peripheral or Mobile device for a monitor, peripheral or phone field), or pick an existing field. After confirmation, a report lists the fields created, already present or refused. Creating a field requires the right to add fields to CMDB types; without it, only picking an existing field is offered;
Dismiss the selection: these fields are no longer suggested or flagged as new. Suggest the selection again, at the bottom of the page, undoes this.

New fields are imported at the next collection.

Enable, edit, delete

The Enabled column button (Yes / No) enables or suspends the source and its scheduled collection.
Edit opens the source page; clearing the schedule removes the scheduled collection, manual synchronization remains possible.
The trash button deletes the source and its scheduled task, after confirmation. Objects already imported stay in the CMDB.