get VPN users email address

[Peter-MIS]

Hello,

I need to write an email to all our CheckPoint (R80.20) VPN user (which are about 200) and for that I need a list with just name and email address (without getting it manually from SmartConsole 🙂).

Is there a short command from maybe mgmt_cli or dbedit to get this list?

Thanks in advance,

Peter

[PhoneBoy]

There are no official APIs for users.
Which means we're stuck using the generic-object API.
The following one-liner should get you what you need in CSV format:

SID=`mgmt_cli -r true login --format json | jq '.sid' -r`; mgmt_cli --session-id $SID show generic-objects class-name "com.checkpoint.objects.classes.dummy.CpmiUser" --format json | jq '.objects[].uid' | while read X; do mgmt_cli --session-id $SID show generic-object uid $X --format json | jq '[.cpmiName, .email] | @csv' -r; done; mgmt_cli --session-id $SID logout > /dev/null

This creates a session (using -r true), gets all the users (up to 500 I think) and queries each use record (by uid) to get the name and email address, then logs the session out.
Output is in CSV format.

[Peter-MIS]

Hello Phone-Boy,

Thanks a lot for your fast response!

Your Oneliner is working, but only for the first 50 (not 500) entries...

How can I change it to get all of my users?

Thanks and best regards,

Peter

[PhoneBoy]

It just means you need to call the API multiple times.
The above part of the command would need to be modified to get the next 50 users as follows:

mgmt_cli --session-id $SID show generic-objects class-name "com.checkpoint.objects.classes.dummy.CpmiUser" limit 50 offset 50 --format json

Then change it to "offset 100" to get the next 50, etc.
I'm sure this could be scripted easily enough parsing the initial output of the API.

[abihsot__]

max is 500, so it will cover all your 200 users in one go.

[Peter-MIS]

Hi abihsot_

maybe it should, but it didn't work for me: I only got 50...

But with the suggestion from PhoneBoy "limit 50 offset 50 " and calling it 4 times (with different offset) everything is working fine for me.

Thanks all a lot for your help!

Peter

[PhoneBoy]

Some API calls have different limits to them.
I assumed (incorrectly) it was 500 in this case.