Change expiration date of users using generic-object API calls

Jim_Oqvist — Mon, 09 Apr 2018 08:27:49 GMT

This document explains the steps to change expiration date of users defined in the R80.x Check Point Security Management Server using the generic-object API.

Disclaimer

These APIs provide direct access to different objects and fields in the database. As a result if an objects schema change, scripts that relied on specific schema fields may break.

As the generic-object(s) API calls have direct access to change different objects and fields in the database, they do not always provide data validation to ensure that the data added to the fields are following required format for this field. Therefore you have to ensure that the script or 3rd party system you are using to integrate with the management server is doing appropriate data validation before sending the API call.

When you have the option, always prefer to use the documented API calls and not the generic API calls as

They are doing data validation
They are documented
They are future compatible
They are tested
They are supported by Technical Assistance Center (TAC)

Data flow

The data flow for the generic API calls are the same as when using the documented API
(Login) > (Show) > (Change) > (Publish) > (Logout)

Login to session
POST https://<mgmt-server>:<port>/web_api/login
Show properties and get UID of object you want to change
POST https://<mgmt-server>:<port>/web_api/show-generic-objects
Change Expiration date and verify new values
POST https://<mgmt-server>:<port>/web_api/set-generic-object
Publish changes
POST https://<mgmt-server>:<port>/web_api/publish
Logout
POST https://<mgmt-server>:<port>/web_api/logout

Format of the API calls

Please refer to the Security Management API reference guide if you need information about the login, publish and logout API calls. https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction~v1.1

The following text is describing the formatting of the generic-objects API calls used to change user expiration date

Request - 2 Show properties and get UID of object you want to change

mgmt_cli tool:

# mgmt_cli -r true -d "SMC User" -f json show generic-objects name "vpnuser" details-level "full"‍‍‍

Web Sevices:

HTTP POST

https://<mgmt-server>:<port>/web_api//show-generic-objects

Headers

Content-Type: application/json

X-chkp-sid: <The SID retrieved from the Login command>

Body

{

"name" : "vpnuser",

"details-level" : "full"

}

Response - In the response you might see multiple objects with the same name. You need to retrieve the UID of the object with "_original_type": "CpmiUser" and check the value of “expirationDate”

Response Body

{….

"adminExpirationBaseData": {

"objId": "f871998d-8e2f-4108-b4af-35a144642897",

"checkPointObjId": null,

"domainId": "41e821a0-3720-11e3-aa6e-0800200c9fde",

"expirationDateVisualNotif": true,

"expirationDate": "25-Apr-2018",

"expirationDateMethod": "EXPIRE_AT",

"folderPath": "1edb57e2-37f3-468f-b613-4a2bcf4e5315",

"text": null,

"folder": "1edb57e2-37f3-468f-b613-4a2bcf4e5315",

"is_owned": false,

"ownedName": "vpnuser"

"days": 127,

"email": "vpnuser@test.local",

"authMethod": "INTERNAL_PASSWORD",

"tohour": "23:59",

"administrator": false,

"uid": "9f55210f-64a5-4cc7-9725-4882c7571c5f ",

……

"_original_type": "CpmiUser"

…….}

Request - 3 Change Expiration date

mgmt_cli tool:

In order to change the users expiration date you will need to provide the CpmiUser object uid. Expiration date needs to be written in date format "dd-mmm-yyyy" for example 10-Apr-2018.

# mgmt_cli -r true -d "SMC User" -f json set generic-object uid "9f55210f-64a5-4cc7-9725-4882c7571c5f" .adminExpirationBaseData.expirationDate "10-Apr-2018"‍‍‍

Using the CLI you can assign the object to a variable and in the next command call that variable. In the CLI you are also able to use the command "date" for example "date --date 2018-04-10 +%d-%b-%Y" to ensure that correct date format is used. The following commands will create the the variables "$varUid" "$varDate" and change the exparation date of the user using these variables

# varUid=$(mgmt_cli -r true -d "SMC User" -f json show generic-objects name "vpnuser" details-level "full" | /opt/CPshrd-R80/jq/jq -r '.objects[] | select (.["_original_type"] | contains ("CpmiUser")) | .uid')
# varDate=$(date --date 2018-04-10 +%d-%b-%Y)
# mgmt_cli -r true -d "SMC User" -f json set generic-object uid "$varUid" .adminExpirationBaseData.expirationDate "$varDate"‍‍‍‍‍‍‍‍‍

Web Sevices:

HTTP POST

https://<mgmt-server>:<port>/web_api//set-generic-object

Headers

Content-Type: application/json

X-chkp-sid: <The SID retrieved from the Login command>

Body

{

"uid":"9f55210f-64a5-4cc7-9725-4882c7571c5f",

"adminExpirationBaseData":{

"expirationDate":"10-Apr-2018"

}

Response – will show you the object properties with the new expiration date

Response Body

{….

"adminExpirationBaseData": {

"objId": "f871998d-8e2f-4108-b4af-35a144642897",

"checkPointObjId": null,

"domainId": "41e821a0-3720-11e3-aa6e-0800200c9fde",

"expirationDateVisualNotif": true,

"expirationDate": "10-Apr-2018",

"expirationDateMethod": "EXPIRE_AT",

"folderPath": "1edb57e2-37f3-468f-b613-4a2bcf4e5315",

"text": null,

"folder": "1edb57e2-37f3-468f-b613-4a2bcf4e5315",

"is_owned": false,

"ownedName": "vpnuser"

},………

Re: Change expiration date of users using generic-object API calls

Robert_Decker — Mon, 09 Apr 2018 08:46:47 GMT

Excellent work, Jim!

Robert.

Re: Change expiration date of users using generic-object API calls

Tomer_Sole — Mon, 09 Apr 2018 19:54:07 GMT

best

Re: Change expiration date of users using generic-object API calls

Kim_Moberg — Fri, 08 Feb 2019 19:29:36 GMT

Good work Jim.

topic Re: Change expiration date of users using generic-object API calls in API / CLI Discussion

Change expiration date of users using generic-object API calls

Data flow

Format of the API calls

Request - 2 Show properties and get UID of object you want to change

Request - 3 Change Expiration date

Re: Change expiration date of users using generic-object API calls

Re: Change expiration date of users using generic-object API calls

Re: Change expiration date of users using generic-object API calls