Using the API to add a user to a group

[eliasen]

Hi all

I am trying to use the API to create users and assign them to a specific usergroup.

I can use the POST to /api/v1/localusers/ to create a user with a relevant JSON as body. This seems to work just fine. I am a bit annoyed that I can't just add the user_groups to that request, but so be it.

Then I can find all usergroups usign this GET: /api/v1/usergroups/ - This will return all the usergroups along with their "resource_uri". This works fine.

Now, how do I add a user to the group? I don't want to use the PATCH to the /api/v1/usergroups because that would require me to include ALL the users in the PATCH-call. I just need to add a user. So I thought the best way was to use the POST to the /api/v1/localgroup-memberships/ - but it fails for me.

If I provide this JSON:

{
"group": "/api/v1/usergroups/2/",
"user": "/api/v1/localusers/25/"
}

I get an error back: "Cannot add facgroup-user relationship "FacGroup_users object (None)" (Response: HTTP 400), Error:"

So... How do I add a newly created localuser to the existing usergroup?

Thanks! :)

  Jan

[Anthony_E]

Hello Jan,

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Regards,

[Anthony_E]

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Regards,

[Anthony_E]

Hello Jan,

Your message has been moved to the Fortinet Forum FortiAuthenticator 

Regards,

[Markus_M]

Hi Jan,

what you might be looking for is this. You can add users to a group incrementally:

https://docs.fortinet.com/document/fortiauthenticator/6.4.2/rest-api-solution-guide/583007/local-use...

This is formally not adding a group membership to a user as you tried, but adding a user to a group as member.

Example:

Add one user to the group:
curl -k -v -u admin:n1bCk66MxiGhHPlj8CnmOdLMmPCaAQrx2GAyTRkU -X POST -d '{"group": "/api/v1/usergroups/1/", "user": "/api/v1/localusers/4/"}' -H 'Content-Type: application/json' https://10.191.19.45/api/v1/localgroup-memberships/
result output:
{"group": "/api/v1/usergroups/1/", "group_name": "testgroup", "id": 3, "resource_uri": "/api/v1/localgroup-memberships/3/", "user": "/api/v1/localusers/4/", "username": "test_user03"}

Add another user to the same group (same command, different user ID #3):
curl -k -v -u admin:n1bCk66MxiGhHPlj8CnmOdLMmPCaAQrx2GAyTRkU -X POST -d '{"group": "/api/v1/usergroups/1/", "user": "/api/v1/localusers/3/"}' -H 'Content-Type: application/json' https://10.191.19.45/api/v1/localgroup-memberships/
result output:
{"group": "/api/v1/usergroups/1/", "group_name": "testgroup", "id": 2, "resource_uri": "/api/v1/localgroup-memberships/2/", "user": "/api/v1/localusers/3/", "username": "test_user02"}

Checking the users/result of the actions above:
curl -k -v -u admin:n1bCk66MxiGhHPlj8CnmOdLMmPCaAQrx2GAyTRkU GET 'https://10.191.19.45/api/v1/localgroup-memberships/'

{"meta": {"limit": 20, "next": null, "offset": 0, "previous": null, "total_count": 2}, "objects": [{"group": "/api/v1/usergroups/1/", "group_name": "testgroup", "id": 2, "resource_uri": "/api/v1/localgroup-memberships/2/", "user": "/api/v1/localusers/3/", "username": "test_user02"}, {"group": "/api/v1/usergroups/1/", "group_name": "testgroup", "id": 3, "resource_uri": "/api/v1/localgroup-memberships/3/", "user": "/api/v1/localusers/4/", "username": "test_user03"}]}

Hope this helps.

Markus

[eliasen]

Hi Markus and thanks for the reply.

I think that this is exactly what I am already doing? You can see a screenshot from postman below - I am using the localgroup-memberships and I am POSTing JSON to add a specific user to a specific group. But it fails and I don't know why.

Any thoughts? Thanks.

[Markus_M]

Hi Jan,

indeed this is pretty much the same. I just tested again with the given curl example. It worked fine.

I will try to get postman running in my lab.

Other question is if you are sure the numbers/IDs of the users are correct? When you hover over the user you will see it or with the GET output I shared:

GET 'https://10.191.19.45/api/v1/localgroup-memberships/'

Best regards,

Markus

[Markus_M]

Something is wrong on your query or with the FAC.

I managed to set up postman and set up a json query with authentication and it also works fine. When I change the IDs to something non-existing, I get an error back

{
"error": "Could not find the provided usergroups object via resource URI '/api/v1/usergroups/130/'."
}

What is your FortiAuthenticator version?

Best regards,

Markus

[eliasen]

Hej Markus and thanks for helping me.

I double-checked the URLs I used the GET on both "usergroups" and "localusers" and they are correct.

I assume you mean this version number:

? Hope that helps? 

Any thoughts on what might be wrong with the FAC?

Thanks! :)

  Jan

[Markus_M]

Hi Jan,

good question; my FortiAuthenticator is on a 6.4.6, not that far away. The release notes for 6.4.5 and 6.4.6 do not show anything that would fix this.

Do you have "curl" somewhere running? It might be giving a different output or more info. On Windows the easiest way might be the "Windows Subsystem for Linux" (WSL) and from that Ubuntu system inside Windows, you can run curl in the same command set I posted.

More details of the "error" on your screenshot might be helpful (it looks like there is a second line or cut-off line after the word "Error").

Generally, the HTTP 400 would normally say that the request you made to the web server is not correct.

Best regards,

Markus