topic Re: How to grant permission for the web api? in API / CLI Discussion

How to grant permission for the web api?

Albert_Chang — Mon, 27 May 2019 08:32:13 GMT

I just install the Check Point API Python Development Kit and run a simple login. But it says "You don't have permission to access /web_api/login this server.

How could I troubleshoot the issue?

Code:

import getpass
from cpapi import APIClient, APIClientArgs

api_server = "fwmgr"
username = input("Enter username: ")
password = getpass.getpass("Enter password: ")

client_args = APIClientArgs(server=api_server)
client = APIClient(client_args)

client.debug_file = "api_calls.json"
login_res = client.login(username, password)
login_res.error_message

Error message returned:

cpapi.api_exceptions.APIException('APIResponse received a response which is not a valid JSON.',
                                  b'<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\n<html><head>\n<title>403 Forbidden</title>\n</head><body>\n<h1>Forbidden</h1>\n<p>You don\'t have permission to access /web_api/login\non this server.<br />\n</p>\n</body></html>\n')

Re: How to grant permission for the web api?

Martin_Raska — Mon, 27 May 2019 15:29:38 GMT

Check API access setting is the SmartConsole, try -all IP addresses

Re: How to grant permission for the web api?

PhoneBoy — Tue, 28 May 2019 04:02:50 GMT

https://community.checkpoint.com/t5/API-CLI-Discussion-and-Samples/Enabling-web-api/m-p/32641#M2011

Re: How to grant permission for the web api?

Albert_Chang — Tue, 28 May 2019 04:31:03 GMT

Hi Martin,

Do you mean to configure an access control rule for API access? Do you have an example?

We already enabled SSH 443 to the firewall manager. Do we need to enable anything else?

Re: How to grant permission for the web api?

Albert_Chang — Tue, 28 May 2019 04:34:51 GMT

Thanks for the reply, PhoneBoy.

Thanks PhoneBoy for the reply.
I am using the Check Point API Python Development Kit for Python. So I don't need to specify "web_api" string in the url.

https://github.com/CheckPointSW/cp_mgmt_api_python_sdk

Re: How to grant permission for the web api?

PhoneBoy — Thu, 30 May 2019 13:24:03 GMT

The reason you are seeing the error is the API server is only available from 127.0.0.1 (localhost) by default.
To fix this, see: https://community.checkpoint.com/t5/API-CLI-Discussion-and-Samples/Enabling-web-api/m-p/32641#M2011

Re: How to grant permission for the web api?

ottis79 — Tue, 06 Apr 2021 13:37:16 GMT

Hi PhoneBoy

I' have the same problem:

<body>

<h1>Forbidden</h1>

<p>You don't have permission to access /web_api/login

on this server.<br />

</p>

</body>

I'm tring to enablr the api by mgmt cli:

login: admin
Password:
Last login: Tue Apr 6 15:28:58 on pts/2
gw-6825d9> mgmt login user admin password xxxx domain "MDS"

and then

gw-6825d9> mgmt_cli -r true set api-settings accepted-api-calls-from "All IP Add
resses"

but I have the 403 error have you a suggestion to activate api?

thanks

Ottavio

Re: How to grant permission for the web api?

PhoneBoy — Tue, 06 Apr 2021 14:32:29 GMT

You haven't restarted the API server?

Re: How to grant permission for the web api?

ottis79 — Tue, 06 Apr 2021 14:38:06 GMT

thanks for you reply, Yes I do, with the command:

api restart

Re: How to grant permission for the web api?

PhoneBoy — Tue, 06 Apr 2021 15:24:52 GMT

What does api status say?

Re: How to grant permission for the web api?

ottis79 — Tue, 06 Apr 2021 15:30:10 GMT

Api status: started

Re: How to grant permission for the web api?

PhoneBoy — Tue, 06 Apr 2021 15:50:35 GMT

What precise IP are you connecting to here?
It should be the the CMA/Domain IP.

Re: How to grant permission for the web api?

ottis79 — Tue, 06 Apr 2021 15:57:33 GMT

My R80 ip is https://192.0.2.80, I'm tring to connect from 192.0.2.81

Re: How to grant permission for the web api?

PhoneBoy — Tue, 06 Apr 2021 16:03:08 GMT

You're either not connecting to the correct IP or there's an issue the TAC probably needs to assist you with.

Re: How to grant permission for the web api?

ottis79 — Tue, 06 Apr 2021 16:07:42 GMT

Hi PhoneBoy

I think the ip is correct because I have a 403 error from R80, I'm not sure that with mgmt_cli I enabled the api to accept all ip addresses. It is possibile from gui to check the configuration?

Thanks

Ottavio

Re: How to grant permission for the web api?

PhoneBoy — Tue, 06 Apr 2021 16:26:57 GMT

SmartConsole will only give you the status of the flag
It won't give you the full details, which api status will give you.
If you're still having issues, you may want to review the file created by api status -s.
And, like I said, a TAC case may be in order.