topic Re: unable to api login to system data domain in some versions of R81.10 in API / CLI Discussion

unable to api login to system data domain in some versions of R81.10

oded_mass — Tue, 23 May 2023 08:38:00 GMT

Hi,

I am getting errors trying to login to the "system data" domain on some R81.10 machines.

using the rest api: POST https://<ip>/web_api/login
it results with:
responseCode : 400, {"code":"err_login_failed","message":"Authentication to server failed."}

loging in to other domains of these machines works fine.

this happens on some R81.10 machine but not on others. (api version on the machine is 1.8)

Is it a known problem? Is there a solution.

Thanks

Re: unable to api login to system data domain in some versions of R81.10

Amir_Senn — Tue, 23 May 2023 10:53:08 GMT

Can you share the syntax you used in the command?

Also, if you try this command locally using SSH, is there any different result?

Re: unable to api login to system data domain in some versions of R81.10

the_rock — Tue, 23 May 2023 14:54:42 GMT

Dont believe it is a known issue. As @Amir_Senn asked, maybe send us the exact syntax you are using. Its certainly odd it happens only on some machines.

Andy

Re: unable to api login to system data domain in some versions of R81.10

oded_mass — Tue, 23 May 2023 15:12:12 GMT

Hellow,

the command is: https://<the ip-address>/web_api/login
the HTTP Method is: POST
and the body is:
{
"user": "the-user",
"password": "the-password",
"domain": "System Data",
"session-timeout": "60"
}

Re: unable to api login to system data domain in some versions of R81.10

the_rock — Tue, 23 May 2023 16:11:14 GMT

Is it same if you try https://ip_address/web_api_login ?

Andy

Re: unable to api login to system data domain in some versions of R81.10

oded_mass — Tue, 23 May 2023 17:12:41 GMT

I do not understand. the documentation for login is:

{{server}}/login

for example https://192.168.0.120/web_api/login
this is what I do (of course with the relevant ip address)

Re: unable to api login to system data domain in some versions of R81.10

the_rock — Tue, 23 May 2023 17:36:46 GMT

I went to that link and it showed me web_api_login...not sure if it makes a difference, but it did work.

Re: unable to api login to system data domain in some versions of R81.10

PhoneBoy — Tue, 23 May 2023 20:05:56 GMT

Are you sure the same credentials work, e.g. with SmartConsole?
Have you confirmed the configured user has API access as part of their permissions profile?
If so, then you may want to get the TAC involved: https://help.checkpoint.com

Re: unable to api login to system data domain in some versions of R81.10

Bob_Zimmerman — Wed, 24 May 2023 00:42:40 GMT

Also is the API set up to allow remote connections? By default, it doesn't. mgmt_cli local on the management will work, but HTTPS connections won't.

Re: unable to api login to system data domain in some versions of R81.10

Hugo_vd_Kooij — Wed, 24 May 2023 05:43:17 GMT

Step 1 should be to run `api status` on the SmartCenter (or MDS).

Step 2 is check access rights for named account.

Step 3 is test with mgmt_cli and same account.

....

Re: unable to api login to system data domain in some versions of R81.10

oded_mass — Wed, 24 May 2023 07:40:58 GMT

The login to "system data" domain is only a part of what my program does.
All other requests work fine.
The program logs in (with no domain name) and gets information about gateways and servers list of domains and other. This all work fine with the same credentials.
It then tries to login to the "System Data". this fails on some machines.
Then depending it it is a multi domain system or not if logs in to the appropriate domain and gets information about "firewall policies and rules". This also works ok with the same credentials.

Re: unable to api login to system data domain in some versions of R81.10

the_rock — Wed, 24 May 2023 13:00:33 GMT

Can you send output of api status?

Re: unable to api login to system data domain in some versions of R81.10

Amir_Senn — Thu, 25 May 2023 08:03:22 GMT

Try to connect without the domain name:

{
"user": "the-user",
"password": "the-password",
"session-timeout": "60"
}

Re: unable to api login to system data domain in some versions of R81.10

oded_mass — Thu, 25 May 2023 17:36:46 GMT

This works and I am using this (no domain) for some API requests.
However for the /show-administrators request I must login to the "System Data" domain.

Re: unable to api login to system data domain in some versions of R81.10

Bob_Zimmerman — Thu, 25 May 2023 18:01:57 GMT

How about logging in with the same credentials locally on the system via 'mgmt_cli -d "System Data" login'?

If that doesn't work, does local root? 'mgmt_cli -d "System Data" -r true login'

If login via HTTP call fails but local works, that points towards the web service. If local login with the same credentials still fails, but local login with the local root works, that points to permissions.