Solved: How to grant permission for the web api?

Albert_Chang · ‎2019-05-27

I just install the Check Point API Python Development Kit and run a simple login. But it says "You don't have permission to access /web_api/login this server.

How could I troubleshoot the issue?

Code:

import getpass
from cpapi import APIClient, APIClientArgs

api_server = "fwmgr"
username = input("Enter username: ")
password = getpass.getpass("Enter password: ")

client_args = APIClientArgs(server=api_server)
client = APIClient(client_args)

client.debug_file = "api_calls.json"
login_res = client.login(username, password)
login_res.error_message

Error message returned:

cpapi.api_exceptions.APIException('APIResponse received a response which is not a valid JSON.',
                                  b'<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\n<html><head>\n<title>403 Forbidden</title>\n</head><body>\n<h1>Forbidden</h1>\n<p>You don\'t have permission to access /web_api/login\non this server.<br />\n</p>\n</body></html>\n')

PhoneBoy · ‎2019-05-30

The reason you are seeing the error is the API server is only available from 127.0.0.1 (localhost) by default.
To fix this, see: https://community.checkpoint.com/t5/API-CLI-Discussion-and-Samples/Enabling-web-api/m-p/32641#M2011

View solution in original post

Martin_Raska · ‎2019-05-27

Check API access setting is the SmartConsole, try -all IP addresses

Albert_Chang · ‎2019-05-27

Hi Martin,

Do you mean to configure an access control rule for API access? Do you have an example?

We already enabled SSH 443 to the firewall manager. Do we need to enable anything else?

PhoneBoy · ‎2019-05-27

https://community.checkpoint.com/t5/API-CLI-Discussion-and-Samples/Enabling-web-api/m-p/32641#M2011

Albert_Chang · ‎2019-05-27

Thanks for the reply, PhoneBoy.

Thanks PhoneBoy for the reply.
I am using the Check Point API Python Development Kit for Python. So I don't need to specify "web_api" string in the url.

https://github.com/CheckPointSW/cp_mgmt_api_python_sdk

PhoneBoy · ‎2019-05-30

The reason you are seeing the error is the API server is only available from 127.0.0.1 (localhost) by default.
To fix this, see: https://community.checkpoint.com/t5/API-CLI-Discussion-and-Samples/Enabling-web-api/m-p/32641#M2011

ottis79 · ‎2021-04-06

Hi PhoneBoy

I' have the same problem:

<body>

<h1>Forbidden</h1>

<p>You don't have permission to access /web_api/login

on this server.<br />

</p>

</body>

I'm tring to enablr the api by mgmt cli:

login: admin
Password:
Last login: Tue Apr 6 15:28:58 on pts/2
gw-6825d9> mgmt login user admin password xxxx domain "MDS"

and then

gw-6825d9> mgmt_cli -r true set api-settings accepted-api-calls-from "All IP Add
resses"

but I have the 403 error have you a suggestion to activate api?

thanks

Ottavio

PhoneBoy · ‎2021-04-06

You haven't restarted the API server?

ottis79 · ‎2021-04-06

Hi

thanks for you reply, Yes I do, with the command:

api restart

PhoneBoy · ‎2021-04-06

What does api status say?

ottis79 · ‎2021-04-06

Api status: started

PhoneBoy · ‎2021-04-06

What precise IP are you connecting to here?
It should be the the CMA/Domain IP.

ottis79 · ‎2021-04-06

My R80 ip is https://192.0.2.80, I'm tring to connect from 192.0.2.81

PhoneBoy · ‎2021-04-06

You're either not connecting to the correct IP or there's an issue the TAC probably needs to assist you with.

ottis79 · ‎2021-04-06

Hi PhoneBoy

I think the ip is correct because I have a 403 error from R80, I'm not sure that with mgmt_cli I enabled the api to accept all ip addresses. It is possibile from gui to check the configuration?

Thanks

Ottavio

PhoneBoy · ‎2021-04-06

SmartConsole will only give you the status of the flag
It won't give you the full details, which api status will give you.
If you're still having issues, you may want to review the file created by api status -s.
And, like I said, a TAC case may be in order.

Are you a member of CheckMates?

How to grant permission for the web api?