topic Re: R80.20 Identity Awareness API in General Topics

R80.20 Identity Awareness API

CP-NDA — Thu, 17 Jan 2019 19:58:37 GMT

Hi,

I'm trying to implement IA API & clearpass however API URL is not responding and pdp API status returns Invalid colmand

Do we need to enable something on the gateway on top of SmartConsole config (IA source)?

Thank you

Re: R80.20 Identity Awareness API

KennyManrique — Fri, 18 Jan 2019 13:20:43 GMT

Hi Nicolas,

Did you enable Identity Web API and allowed the specific hosts under Gateway's IA configuration??

Regards.

Re: R80.20 Identity Awareness API

CP-NDA — Fri, 18 Jan 2019 13:35:20 GMT

Yes it's enabled in SmartConsole

Re: R80.20 Identity Awareness API

PhoneBoy — Fri, 18 Jan 2019 23:15:06 GMT

Did you set the allowed interfaces?

For my first try, I forgot to do that.

Here's what I saw when I queried the API endpoint directly using curl from a Linux machine:

curl --silent --insecure -XPOST https://<gw-ip>/_IA_API/idasdk/show-identity -H "Content-Type: application/json" --data-binary "{}"
<!DOCTYPE html><HTML><HEAD>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=EmulateIE9,EmulateIE8"><meta name="others" content="WEBUI LOGIN PAGE" /><TITLE>Gaia</TITLE>
<link rel="shortcut icon" href="https://community.checkpoint.com/login/fav.ico">
<link rel="stylesheet" type="text/css" href="https://community.checkpoint.com/login/ext-all.css" />
<link rel="stylesheet" type="text/css" href="https://community.checkpoint.com/login/login.css" />
<STYLE TYPE="text/css">
.ext-ie .webui-login-fld{font-size: 11px;}
</STYLE>
<script type="text/javascript" src="/login/ext-base.js"></script><script type="text/javascript" src="/login/ext-all.js"></script><script type="text/javascript">var errMsgText = "";var bannerMsgText = "";bannerMsgText += "This system is for authorized use only.";var hostname='';var version='R80.20';var formAction="/cgi-bin/home.tcl";</script><script type="text/javascript" src="/login/login.js"></script></HEAD><BODY><noscript><div style='font-size:20px;position:relative;top:100px;'>For full functionality of this site it is necessary to enable JavaScript.</div></noscript></BODY></HTML>

This tells me MultiPortal believes the connection should go to the Gaia portal, which is the default.

After setting the allowed interfaces for the IDA API as shown above, I got a different message when querying the API:

curl --silent --insecure -XPOST https://<gw-ip>/_IA_API/idasdk/show-identity -H "Content-Type: application/json" --data-binary "{}"
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
<HEAD>
<TITLE> 404 File Not Found </TITLE>
</HEAD>
<BODY>
The URL you requested could not be found on this server.
</BODY>
</HTML>

When I actually pass the correct information via the API call, I get a meaningful result:

curl --silent --insecure -XPOST https://10.6.5.1/_IA_API/idasdk/show-identity -H "Content-Type: application/json" --data-binary "{ \"shared-secret\": \"aaaa\", \"ip-address\": \"1.1.1.1\" }"
{
"ipv4-address" : "1.1.1.1",
"message" : "total 0 user records were found."
}

Re: R80.20 Identity Awareness API

CP-NDA — Sat, 19 Jan 2019 06:00:54 GMT

Hi Dameon,

Yes of course we did but we don't get any answer from API... We also tried to change setting On all interface to make sure but without success

I will try to reboot the gateway this weekend or open a TAC ticket

Thank you

Re: R80.20 Identity Awareness API

PhoneBoy — Sat, 19 Jan 2019 18:10:43 GMT

No answer at all?

Maybe the firewall access policy is blocking the traffic.

Any logs?

What does tcpdump/fw monitor show?

Re: R80.20 Identity Awareness API

Soeren_Rothe — Wed, 31 Mar 2021 12:32:10 GMT

In R81 your command didn't work for me.

This worked for me:

curl -k -H "Content-Type: application/json" -d $'{"shared-secret":"aaaaaaa",\n "ip-address":"192.168.1.11"}' https://192.168.0.1/_IA_API/v1.0/show-identity

[root@lnx ~]# curl -k -H "Content-Type: application/json" -d $'{"shared-secret":"aaaaaaaa",\n "ip-address":"192.168.0.11"}' https://192.168.0.1/_IA_API/v1.0/show-identity { "ipv4-address" : "192.168.0.11", "message" : "total 0 user records were found." } [root@lnx ~]#