topic Re: get VPN users email address in API / CLI Discussion

get VPN users email address

Peter-MIS — Thu, 27 Feb 2020 16:38:36 GMT

Hello,

I need to write an email to all our CheckPoint (R80.20) VPN user (which are about 200) and for that I need a list with just name and email address (without getting it manually from SmartConsole 🙂).

Is there a short command from maybe mgmt_cli or dbedit to get this list?

Thanks in advance,

Peter

Re: get VPN users email address

PhoneBoy — Mon, 02 Mar 2020 01:57:58 GMT

There are no official APIs for users.
Which means we're stuck using the generic-object API.
The following one-liner should get you what you need in CSV format:

SID=`mgmt_cli -r true login --format json | jq '.sid' -r`; mgmt_cli --session-id $SID show generic-objects class-name "com.checkpoint.objects.classes.dummy.CpmiUser" --format json | jq '.objects[].uid' | while read X; do mgmt_cli --session-id $SID show generic-object uid $X --format json | jq '[.cpmiName, .email] | @csv' -r; done; mgmt_cli --session-id $SID logout > /dev/null

This creates a session (using -r true), gets all the users (up to 500 I think) and queries each use record (by uid) to get the name and email address, then logs the session out.
Output is in CSV format.

Re: get VPN users email address

Peter-MIS — Tue, 03 Mar 2020 13:01:51 GMT

Hello Phone-Boy,

Thanks a lot for your fast response!

Your Oneliner is working, but only for the first 50 (not 500) entries...

How can I change it to get all of my users?

Thanks and best regards,

Peter

Re: get VPN users email address

PhoneBoy — Tue, 03 Mar 2020 16:17:24 GMT

It just means you need to call the API multiple times.
The above part of the command would need to be modified to get the next 50 users as follows:

mgmt_cli --session-id $SID show generic-objects class-name "com.checkpoint.objects.classes.dummy.CpmiUser" limit 50 offset 50 --format json

Then change it to "offset 100" to get the next 50, etc.
I'm sure this could be scripted easily enough parsing the initial output of the API.

Re: get VPN users email address

abihsot__ — Wed, 04 Mar 2020 16:35:24 GMT

max is 500, so it will cover all your 200 users in one go.

Re: get VPN users email address

Peter-MIS — Wed, 04 Mar 2020 17:31:17 GMT

Hi abihsot_

maybe it should, but it didn't work for me: I only got 50...

But with the suggestion from PhoneBoy "limit 50 offset 50 " and calling it 4 times (with different offset) everything is working fine for me.

Thanks all a lot for your help!

Peter

Re: get VPN users email address

PhoneBoy — Wed, 04 Mar 2020 23:58:04 GMT

Some API calls have different limits to them.
I assumed (incorrectly) it was 500 in this case.