topic Re: [Ansible] Unable to obtain sid in Ansible

[Ansible] Unable to obtain sid

Simon_Andersso1 — Mon, 18 Jun 2018 12:59:25 GMT

I'm trying to write a simple ansible play, containing only a login and a logout task, by following the instructions found here: https://github.com/CheckPointSW/cpAnsible .

My playbook looks like this:

---
- hosts: "firewalls"
tasks:
- name: "login"
    check_point_mgmt:
      command: login
      parameters:
        username: "{{mgmt_user}}"
        password: "{{mgmt_password}}"
        management: "{{mgmt_server}}"
      fingerprint: "{{mgmt_fingerprint}}"
    register: login_response

- name: "logout"
    check_point_mgmt:
      command: logout
      session-data: "{{login_response}}"

The login goes ok, but the logout task fails with the following error:

fatal: [127.0.0.1]: FAILED! => {"changed": false, "msg": "Command 'logout None' failed with error message: Missing header: [X-chkp-sid]. All changes are discarded and the session is invalidated."}

It appears I am unable to obtain a session-id, but I have no idea of how to resolve this.

Re: [Ansible] Unable to obtain sid

Robert_Decker — Mon, 18 Jun 2018 13:14:08 GMT

Do you have any indication that login command was successful?

session-data holds the session-id inside.

robert.

Re: [Ansible] Unable to obtain sid

Simon_Andersso1 — Mon, 18 Jun 2018 13:31:16 GMT

To be honest, I'm not sure. When running the playbook with the --verbose flag the login task shows ok but sid shows "null".

Here is my full output:

PLAY [firewalls] ********************************************************************

TASK [Gathering Facts] **************************************************************
ok: [127.0.0.1]

TASK [login] ************************************************************************
ok: [127.0.0.1] => {"changed": false, "response": {"domain": null, "fingerprint": "002451E2D9743CDACC8F7178761FAE4C017AB039", "sid": null, "url": "10.99.81.101:443"}}

TASK [logout] ***********************************************************************
fatal: [127.0.0.1]: FAILED! => {"changed": false, "msg": "Command 'logout None' failed with error message: Missing header: [X-chkp-sid]. All changes are discarded and the session is invalidated."}
to retry, use: --limit @/home/simand/ansible_platform/cp_test.retry

PLAY RECAP **************************************************************************
127.0.0.1 : ok=2 changed=0 unreachable=0 failed=1

Re: [Ansible] Unable to obtain sid

Robert_Decker — Mon, 18 Jun 2018 13:41:15 GMT

have you configured your management API server to accept connections from remote machines?

Re: [Ansible] Unable to obtain sid

Simon_Andersso1 — Mon, 18 Jun 2018 13:47:12 GMT

I feel so stupid now. I had completely missed that step in the tutorial. Thank you.

Re: [Ansible] Unable to obtain sid

Tribhawan_Singh — Tue, 11 Dec 2018 02:39:52 GMT

Hello Dameon Welch-Abernathy‌ and other folks,

I need your help to fix 1 issue .
While executing your given script in my test environment i am getting below error:
TASK [Add CheckMatesDemo group] ****************************************************************************************************************************************
fatal: [localhost]: FAILED! => {"changed": false, "msg": "Command 'add-group {u'name': u'CheckMatesDemo'}'
failed with error message: Missing header: [X-chkp-sid]. All changes are discarded and the session is invalidated."}
to retry, use: --limit @/etc/ansible/cp2.retry

I am trying to execute CheckMates_AddHost.yml

FYI: API is enable on the MGMT server for all IP addresses but don't know why SID is coming as null.

Re: [Ansible] Unable to obtain sid

PhoneBoy — Tue, 11 Dec 2018 05:17:36 GMT

Which "given script" are you discussing?

I recommend posting the question on the relevant thread where the script was shared with more details about how exactly you are invoking it.

In general, you have to "login" to the API, which will generate a session ID.

That session ID would be passed via a X-chkp-sid on subsequent calls to the API.

My guess is in the ansible playbook you called, you forgot the login action.

But, like I said, I recommend continuing the discussion on the relevant thread.

Re: [Ansible] Unable to obtain sid

Tribhawan_Singh — Tue, 11 Dec 2018 12:37:24 GMT

Thanks for the reply Dameon Welch-Abernathy‌

There was some permission issue. post correction that everything worked as expected.

Re: [Ansible] Unable to obtain sid

James_Le — Tue, 30 Apr 2019 00:59:06 GMT

Hello, I'm getting the same error message and I've tried many things but doesn't work. Do you mind elaborating what you did to resolve your issues? Thanks.