Hi Stuart,
Yes, I've already seen this site that you just mentioned... and it looks as if it should be supported ... but it doesn't work for me.
I have the newest ansible and the newest checkpoint module:
# ansible --version
ansible [core 2.12.9]
config file = /etc/ansible/ansible.cfg
configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /usr/lib/python3/dist-packages/ansible
ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections
executable location = /usr/bin/ansible
python version = 3.9.2 (default, Feb 28 2021, 17:03:44) [GCC 10.2.1 20210110]
jinja version = 2.11.3
libyaml = True
# head .ansible/collections/ansible_collections/check_point/mgmt/CHANGELOG.rst
==============================
Check_Point.Mgmt Release Notes
==============================
.. contents:: Topics
v4.0.0
======
And of course when I change /etc/ansible/hosts to use ansible_api_key ... I also comment out/remove ansible_user + ansible_password
What's funny is that when I have this ansible_api_key in /etc/ansible/hosts it works "strange" because ansible starts with "logout" command 🙂
# tail -f $FWDIR/log/api.elg
2022-11-02 17:00:58,049 INFO org.apache.cxf.interceptor.LoggingInInterceptor.log:250 [qtp1587849480-90] - Inbound Message
----------------------------
ID: 12199
Address: http://127.0.0.1:65456/web_api/logout
Encoding: UTF-8
Http-Method: POST
Content-Type: application/json
Headers: {accept-encoding=[identity], connection=[keep-alive], Content-Length=[2], content-type=[application/json], Host=[127.0.0.1:65456], User-Agent=[Ansible], X-Forwarded-For=[172.19.99.100], X-Forwarded-Host=[172.19.99.253:443], X-Forwarded-Host-Port=[443], X-Forwarded-Server=[172.19.99.253]}
Payload: {}
--------------------------------------
2022-11-02 17:00:58,049 ERROR com.checkpoint.management.web_api.core.cxf.interceptor.WebApiInInterceptorSessionValidator.handleMessage:31 [qtp1587849480-90] - Session validation has failed
(...)
ID: 12199
Response-Code: 400
Content-Type: application/json
Headers: {Content-Type=[application/json], Date=[Wed, 02 Nov 2022 16:00:58 GMT]}
Payload: {
"code" : "generic_err_missing_required_header",
"message" : "Missing header: [X-chkp-sid]"
}
no login ... first ... so it's not strange that logout doesn't have session_id 🙂
And no entry at all into $FWDIR/log/api.csv...
But with ansible_user + ansible_password:
2022-11-02 17:04:59,426 DEBUG com.checkpoint.management.web_api.core.cxf.interceptor.WebApiInInterceptorLoginValidator.handleMessage:32 [qtp1587849480-88] - Validating 'login' command of the version: [1.8]
2022-11-02 17:04:59,426 INFO org.apache.cxf.interceptor.LoggingInInterceptor.log:250 [qtp1587849480-88] - Inbound Message
----------------------------
ID: 12203
Address: http://127.0.0.1:65456/web_api/login
Encoding: UTF-8
Http-Method: POST
Content-Type: application/json
Headers: {accept-encoding=[identity], Authorization=[Basic YWRtaW46MXFhekBXU1g=], connection=[keep-alive], Content-Length=[41], content-type=[application/json], Host=[127.0.0.1:65456], User-Agent=[Ansible], X-Forwarded-For=[172.19.99.100], X-Forwarded-Host=[172.19.99.253:443], X-Forwarded-Host-Port=[443], X-Forwarded-Server=[172.19.99.253]}
(...)
ID: 12203
Response-Code: 200
Content-Type: application/json
Headers: {Content-Type=[application/json], Date=[Wed, 02 Nov 2022 16:05:00 GMT]}
Payload: {
"uid" : "2d35b5f9-2b61-4b75-9e6d-8ac8656d195f",
"sid" : "ad05d22ae40bc55426980e0a93b82433",
"url" : "https://172.19.99.253:443/web_api",
"session-timeout" : 600,
"last-login-was-at" : {
"posix" : 1667378605905,
"iso-8601" : "2022-11-02T09:43+0100"
},
"api-server-version" : "1.8",
"user-name" : "admin",
"user-uid" : "33efce7f-77bb-4874-859b-793b83190f48"
}
No issues at all 😉
And of course in $FWDIR/log/api.csv I see:
2022-11-02,17:07:06 +0100,"Ansible","172.19.99.100","172.19.99.253:443",login,PASSED,855
--
Best
Marcin
