How can I programmatically create an api role (SOAP)

Question

I would like to programmatically create an api role with the installation of a module. I have a data install script located at

namespace/module/data/namespace_module_setup/data-install-1.0.0.php

How should I go about doing this?

Something perhaps like?:

$apirole = Mage::getModel('api/role')->setData(array(''=>''));

Answer 1

I ended up doing something like the following in my data-install-1.0.0.php script, which creates a new role and user with 'all' privileges.

$api_key = "your_key_here";

$api_role = Mage::getModel('api/roles')
        ->setName('<module>')
        ->setPid(false)
        ->setRoleType('G')
        ->save();

Mage::getModel('api/rules')
        ->setRoleId($api_role->getId())
        ->setResources(array('all'))
        ->saveRel();

$api_user = Mage::getModel('api/user');

$api_user->setData(array(
        'username' => '<module>',
        'firstname' => '<module>',
        'lastname' => '<module>',
        'email' => 'support@<module>.com',
        'api_key' => $api_key,
        'api_key_confirmation' => $api_key,
        'is_active' => 1,
        'user_roles' => '',
        'assigned_user_role' => '',
        'role_name' => '',
        'roles' => array($api_role->getId())
          ));

$api_user->save()->load($api_user->getId());

$api_user->setRoleIds(array($api_role->getId()))
        ->setRoleUserId($api_user->getUserId())
        ->saveRelations();

Of course this is simplified, you would likely want to include some error handling.

UPDATE: If you're following along you may run into an issue with the above code not saving your api key. If so try the following:

$salt = ('somekindofsalthere');

$api_key = md5($salt.'somekindOfPasswordHere02').':'.$salt;

Now, rather than using $api_user->setData() with api_key and api_key_confirmation, we're going to set the api key this way (notice the above 2 parameters have been removed and replaced with a new method below):

$user->setData(array(
            'username' => '<module>',
            'firstname' => '<module>',
            'lastname' => '<module>',
            'email' => 'support@<module>.com',
            'is_active' => 1,
            'user_roles' => '',
            'assigned_user_role' => '',
            'role_name' => '',
            'roles' => array($role->getId())
        ));
$user->setApiKey($api_key);

This should save your key to your newly created api user. Keep in mind the api key will not display on the backend, as those fields are for updating to a new key, and will not display the current key.

Answer 2

I expect that others (like me) will find this question in search of a pure-SQL method of creating these API users. Below you can find a solution for creating a new API user with "All" permissions. Just modify the first few variables to set your desired user/pass, then run these queries against the database.

SET @api_password='super_secret'; -- Set your desired API password here
SET @api_username='export_connector'; -- Set your desired API username here
SET @api_email='example@example.com'; -- Change this if you want.

SELECT @api_password_hash:=md5(@api_password);

INSERT INTO `api_role` (`role_id`, `parent_id`, `tree_level`, `sort_order`, `role_type`, `user_id`, `role_name`)
VALUES
    (NULL, 0, 1, 0, 'G', 0, 'Export Connector');

SELECT @new_role_id:=LAST_INSERT_ID();
INSERT INTO `api_rule` (`rule_id`, `role_id`, `resource_id`, `api_privileges`, `assert_id`, `role_type`, `api_permission`)
VALUES
    (NULL, @new_role_id, 'all', NULL, 0, 'G', 'allow');

INSERT INTO `api_user` (`user_id`, `firstname`, `lastname`, `email`, `username`, `api_key`, `created`, `modified`, `lognum`, `reload_acl_flag`, `is_active`)
VALUES
    (NULL, 'Export', 'Connector', @api_email, @api_username, @api_password_hash, NOW(), NOW(), 0, 0, 1);

SELECT @new_user_id:=LAST_INSERT_ID();
INSERT INTO `api_role` (`role_id`, `parent_id`, `tree_level`, `sort_order`, `role_type`, `user_id`, `role_name`)
VALUES
    (NULL, @new_role_id, 1, 0, 'U', @new_user_id, 'Export');

If you use table prefixes, you'll need to change the table names. You can probably change the firstname/lastname/role name too, but I didn't try.

Reason for doing this with pure-SQL is that we manage hundreds of Magento stores, each with differing codebases. We needed to get API access into them to pull data out, without making [testing] code changes in each store, and manually creating these would be extremely tedious.