Technical Tip: cURL syntax on FortiAuthenticator API

[simonz_FTNT]

Description

This article provides some basic commands for using cURL to query and update the FortiAuthenticator user LDAP.

Scope

FortiAuthenticator v4.0.x, v5.0.x, v6.0.x.

Solution

To use the API, an admin user must be created with web service access enabled, as shown in the following screenshot. A valid email address must be provided under the User Information section as it will receive the secret key needed to be used in the cURL server connection.

 

The cURL program for the appropriate platform can be downloaded from http://curl.haxx.se/download.html

The cURL syntax is as follows:

curl –k –v –u “:” https:///api/v1//?format=json <-----The credentials shown below are an example only, the correct credentials must be provided during admin user creation.

To list all Local users:

curl -k -v -u "szadmin:ytYq8QwNPhpNlPJqAPIeGVBB0xQsFkaau80WW4Xy" https://10.129.0.60/api/v1/localusers/?format=json

To list all LDAP users

curl -k -v -u "szadmin:ytYq8QwNPhpNlPJqAPIeGVBB0xQsFkaau80WW4Xy" https://10.129.0.60/api/v1/ldapusers/?format=json
To list available token

curl -k -v -u "szadmin:ytYq8QwNPhpNlPJqAPIeGVBB0xQsFkaau80WW4Xy" https://10.129.0.60/api/v1/fortitokens/?status=available

It is a two-step process to assign a Token to an LDAP user.

1. List the existing LDAP user information.

curl -k -v -u "szadmin:ytYq8QwNPhpNlPJqAPIeGVBB0xQsFkaau80WW4Xy" https://10.129.0.60/api/v1/localusers/?username=<ldapusername>

The following output will be displayed:

< HTTP/1.1 200 OK
< Date: Sun, 13 Dec 2015 09:28:58 GMT
< Server: Apache
< Vary: Accept,Accept-Language,Cookie
< X-Frame-Options: SAMEORIGIN
< Content-Language: en
< Cache-Control: no-cache
< Transfer-Encoding: chunked
< Content-Type: application/json
<
{"meta": {"limit": 20, "next": null, "offset": 0, "previous": null, "total_count": 1}, "objects": [{"active": true, "dn": "CN=stan,CN=Users,DC=sz,DC=com,DC=local", "email": "", "first_name": "stan", "ftm_act_method": "email", "id": 3, "last_name": "", "mobile_number": "", "resource_uri": "/api/v1/ldapusers/3/", "server_address": "10.129.0.50", "server_name": "SZ_AD","token_auth": false, "token_serial": "", "token_type": "", "username": "stan"}

2. Run the following command to assign an available Token to user ID = 3, together with the email address. An email address is needed when assigning Token, as it will send the information required to register the mobile token:

curl -k -v -u "szadmin:ytYq8QwNPhpNlPJqAPIeGVBB0xQsFkaau80WW4Xy" -X PATCH -d {\"token_auth\":\"true\",\"token_type\":\"ftm\",\"email\":\"test@abc.com\"} -H "Content-Type: application/json" https://10.129.0.60/api/v1/ldapusers/3/

Note:

Replace the ID '3”' without the bracket, with the correct ID from the user listing.  For example: https://10.129.0.60/api/v1/ldapusers/<3>/