Cannot change GAiA admin password via ansible/API

[cm]

Hi,

I'm trying to automate initial configuration of GAiA gateways and I have an issue when trying to change the password for "admin", like this:

  - name: set admin user password hash
    check_point.gaia.cp_gaia_user:
      name: admin
      password_hash: $6$xxxxx
      must_change_password: False

When I try this, I get an error:

Checkpoint device returned error 400 with message {'code': 'err_validation_failed', 'errors': 'Cannot change this attribute of user admin', 'msg': 'Validation Error'}

This also happens when I use "password" instead of "password_hash", and it is limited to the "admin" user. I am accessing the API as a separate user "apiuser" because I thought maybe the password of the accessing user cannot be changed, but that's not the issue.

This is on R81.20 JHF89/API level 1.7

So, how do I change that password via the API and ansible?

[the_rock]

Is this management or gateway?

Andy

[the_rock]

https://sc1.checkpoint.com/documents/latest/APIs/?#clish/set-user~v2%20

[cm]

That's on the gateway, so using the GAiA API, not the mgmt API...

[the_rock]

Hm, that link I sent is gaia cli.

Andy

https://sc1.checkpoint.com/documents/latest/APIs/?#clish/set-user~v1.7%20

[cm]

I don't think so. That's just the management API as called from clish, not the GAiA API which is a different beast. The link you posted affects the user objects in the SMC, not the GAiA users...

[the_rock]

Maybe below?

Andy

https://sc1.checkpoint.com/documents/latest/GaiaAPIs/#web/set-user~v1.8%20

[PhoneBoy]

Just to confirm, you can change other users passwords using this playbook, but not the admin user?

[Jim_Oqvist]

Hi,

it seems to be a bug in the ansible collection.

it is possible to change the admin password using the set-user api call directly (https://sc1.checkpoint.com/documents/latest/GaiaAPIs/index.html#cli/set-user~v1.7%20).

It also seems like this is only triggered when trying to change the password of the user "admin" if you crate a new user for example called test it works as expected.

This is reproducible with this playbook https://github.com/checkpointsw-devsec/chkp-api-examples/blob/master/Ansible/Gaia/cp_gaia_user.yml 

I suggest you open a issue here: https://github.com/CheckPointSW/CheckPointAnsibleGAIACollection or if you open a service request with TAC to get it solved.

Kind Regards

Jim