Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
chimera
New Contributor

RESTAPI admin and access, under firmware v5.6

I see the newer firmware the menu option gives the ability to setup a specific RESTAPI user.

 

I've created a user (called ‘restapi’) and got a token for it, but when I curl to it, it gives me authentication error. Any ideas? (see curl output below)

 

I do notice when creating the RESTAPI user, it mentions a PKI group. I have this disabled this setting when I created and tested access, but then the message box with it enabled says “REST API clients must use client certification authentication…” As mentioned I turned this off, but suspect this is the issue – as it does say must.  I drop down the PKI drop box but don’t see a PKI group and have no idea how to create one, I’ve looked but cannot work it out. I’ve tried documentation on Fortinet site, but its fairly average.  Any help would be appreciated.  Here is the output of a basic curl I'm running:

 

pi@raspberrypi:~ $ curl -k -v -u "restapi:m7Qz4knrhn7sfNschHjp6Qwb1qb88f" https://172.16.221.254:8443/api/v1/

* Trying 172.16.221.254...
* TCP_NODELAY set
* Connected to 172.16.221.254 (172.16.221.254) port 8443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
* subject: O=Fortinet Ltd.; CN=FWF60D4613004145
* start date: Oct 9 20:49:34 2017 GMT
* expire date: Oct 10 20:49:34 2027 GMT
* issuer: O=Fortinet Ltd.; CN=FWF60D4613004145
* SSL certificate verify result: self signed certificate (18), continuing anyway.
* Server auth using Basic with user 'restapi'
> GET /api/v1/ HTTP/1.1
> Host: 172.16.221.254:8443
> Authorization: Basic cmVzdGFwaTptN1F6NGtucmhuN3NmTnNjaEhqcDZRd2IxcWI4OGY=
> User-Agent: curl/7.52.1
> Accept: */*
>
< HTTP/1.1 401 UNAUTHORIZED
< Date: Mon, 30 Oct 2017 20:41:29 GMT
< Server: xxxxxxxx-xxxxx
< Content-Security-Policy: frame-ancestors 'self'
< Expires: Mon, 30 Oct 2017 20:41:29 GMT
< Vary: Cookie,Accept-Encoding
< Last-Modified: Mon, 30 Oct 2017 20:41:29 GMT
< X-UA-Compatible: IE=Edge
< Cache-Control: max-age=0
< X-FRAME-OPTIONS: SAMEORIGIN
< Set-Cookie: csrftoken_2211073454=d7f8f9fa154987cccdf47d0d0adcd513; expires=Mon, 29-Oct-2018 20:41:29 GMT; Max-Age=31449600; Path=/
< Transfer-Encoding: chunked
< Content-Type: text/html; charset=utf-8
<
<!DOCTYPE html>
<html lang="en">
<head>
<title>Error</title>
<meta charset="utf-8">
<meta http-equiv="Content-Type" content="text/html">
<meta http-equiv="pragma" content="no-cache">
<script>
var is_rw_admin = false;
var is_guest = false;
var is_ipv6_enabled = false;
var gui_lines_per_page = 50;
var lang_dict = {};
window.onerror = function(msg, file, line) {
    if (('$j' in window) && ('JSON' in window)) {
        $j.post("/api/monitor?path=system&name=debug", {
            "json": JSON.stringify({
                "type": "JavaScript",
                "msg": msg,
                "file": file,
                "line": line
            })
        });
    }
};
</script><link href="/cad9763523c690ddffc1d3950311a00a/css/main-blue.css" rel="stylesheet" type="text/css">

<script src="/cad9763523c690ddffc1d3950311a00a/js/es6-shim.js"></script>
<script src="/cad9763523c690ddffc1d3950311a00a/lang/en.js"></script>
<script src="/cad9763523c690ddffc1d3950311a00a/fweb_all.js"></script>

<script src="/cad9763523c690ddffc1d3950311a00a/js/dialog.js"></script>
</head>

<body class="main" data-theme="blue">
<div style='display:none'><input type='hidden' name='csrfmiddlewaretoken' value='d7f8f9fa154987cccdf47d0d0adcd513' /></div><div class="dialog absolute" >
<form method="post" action="" >
<div style='display:none'><input type='hidden' name='csrfmiddlewaretoken' value='d7f8f9fa154987cccdf47d0d0adcd513' /></div>
<div class="title-bar">
<h1>Error</h1>
</div>

<div class="content ">
<div class="section-title">
    <h2>Error 401: Unauthorized.</h2>
</div>
</div>

<div class="footer">
    <button class="primary" type="button"
        onclick="dlg_close((null))"
        data-fweb-action="cancel"
>
OK </button>
</div>

</form>
</div>

<script>
$(document).ready(function() {
  $('textarea[expand]').textarea();
});
</script>
</body>
* Curl_http_done: called premature == 0
* Connection #0 to host 172.16.221.254 left intact

6 REPLIES 6
megassa
New Contributor

Hello,

 

I have the same issue, did you find a solution ? thanks in advance.

xxddpac

Did you find a solution ?

 

I'm using Python have same issue.

 

<TITLE>401 Authorization Required</TITLE>

emnoc
Esteemed Contributor III

Have you   used the logincheck  , I believe even with the  defined  user, you still make the calls in the same way.

 

http://socpuppet.blogspot.com/2018/07/howto-use-fortios-api-to-add-delete.html

 

Ken Felix

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
xxddpac
New Contributor

emnoc wrote:

Have you   used the logincheck  , I believe even with the  defined  user, you still make the calls in the same way.

 

http://socpuppet.blogspot.com/2018/07/howto-use-fortios-api-to-add-delete.html

 

Ken Felix

I used logincheck with python is no problem, but used api-key have a issue.

 

xxddpac
New Contributor

emnoc wrote:

Have you   used the logincheck  , I believe even with the  defined  user, you still make the calls in the same way.

 

http://socpuppet.blogspot.com/2018/07/howto-use-fortios-api-to-add-delete.html

 

Ken Felix

import json,urllib3,requests
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
url = "https://X.X.X.X:4433"
fgt_url = "https://X.X.X.X:4433/logincheck"
# fgt_coo = requests.post(fgt_url,data={"username":"aaaaa","secretkey":"aaaaaaa",
# "ajax":1},verify = False)
# headers = {"Cookie":"APSCOOKIE_2405464622=%s;ccsrftoken=%s"%(fgt_coo.cookies.get("APSCOOKIE_2405464622"),
# fgt_coo.cookies.get("ccsrftoken"))}
myToken = "9qcGftQshfk9Hhqp9Gzxxx7rd14djg"
apikey = {'Authorization': 'python {}'.format(myToken)}
cmdb = url + "/api/v2/cmdb"
res = requests.get(url = cmdb,headers = apikey,verify = False)
print res.content
# result = json.loads(res.content)
# print result["version"]
# print result["serial"]

and result :
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><HTML><HEAD>
<TITLE>401 Authorization Required</TITLE>
</HEAD><BODY>
<H1>Authorization Required</H1>
This server could not verify that you
are authorized to access the document
requested. Either you supplied the wrong
credentials (e.g., bad password), or your
browser doesn't understand how to supply
the credentials required.<P>
<P>Additionally, a 401 Authorization Required
error was encountered while trying to use an ErrorDocument to handle the request.
</BODY></HTML>
emnoc
Esteemed Contributor III

try curl and see what happens against the  URL 

 

e.g 

curl -v -k  -d '{"Authorization":"9qcGftQshfk9Hhqp9Gzxxx7rd14djgi"}' -H "Content-

Type: application/json"  -X POST  "https://x.x.x.x/logincheck/blahblah"

 

I will probably   test it tonight if I have the chance and add a  new  post on the blog. Been working some forcepoint SMC API issues so I'm all "API"'ed out at this  time ;)

 

So we use a apikey also in the SMC and making our call to the correct  URL will provide a status.code 200, the fortiOS should be similar 

 

I suspect the  issues is a bad key or wrong URL path. IIRC logincheck is not used but I could be wrong.

 

 

Ken Felix                       

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Labels
Top Kudoed Authors