Re: R80.20 Identity Awareness API

CP-NDA · ‎2019-01-17

Hi,

I'm trying to implement IA API & clearpass however API URL is not responding and pdp API status returns Invalid colmand

Do we need to enable something on the gateway on top of SmartConsole config (IA source)?

Thank you

KennyManrique · ‎2019-01-18

Hi Nicolas,

Did you enable Identity Web API and allowed the specific hosts under Gateway's IA configuration??

Regards.

CP-NDA · ‎2019-01-18

Yes it's enabled in SmartConsole

PhoneBoy · ‎2019-01-18

Did you set the allowed interfaces?

For my first try, I forgot to do that.

Here's what I saw when I queried the API endpoint directly using curl from a Linux machine:

curl --silent --insecure -XPOST https://<gw-ip>/_IA_API/idasdk/show-identity -H "Content-Type: application/json" --data-binary "{}"
<!DOCTYPE html><HTML><HEAD>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=EmulateIE9,EmulateIE8"><meta name="others" content="WEBUI LOGIN PAGE" /><TITLE>Gaia</TITLE>
<link rel="shortcut icon" href="https://community.checkpoint.com/login/fav.ico">
<link rel="stylesheet" type="text/css" href="https://community.checkpoint.com/login/ext-all.css" />
<link rel="stylesheet" type="text/css" href="https://community.checkpoint.com/login/login.css" />
<STYLE TYPE="text/css">
.ext-ie .webui-login-fld{font-size: 11px;}
</STYLE>
<script type="text/javascript" src="/login/ext-base.js"></script><script type="text/javascript" src="/login/ext-all.js"></script><script type="text/javascript">var errMsgText = "";var bannerMsgText = "";bannerMsgText += "This system is for authorized use only.";var hostname='';var version='R80.20';var formAction="/cgi-bin/home.tcl";</script><script type="text/javascript" src="/login/login.js"></script></HEAD><BODY><noscript><div style='font-size:20px;position:relative;top:100px;'>For full functionality of this site it is necessary to enable JavaScript.</div></noscript></BODY></HTML>

This tells me MultiPortal believes the connection should go to the Gaia portal, which is the default.

After setting the allowed interfaces for the IDA API as shown above, I got a different message when querying the API:

curl --silent --insecure -XPOST https://<gw-ip>/_IA_API/idasdk/show-identity -H "Content-Type: application/json" --data-binary "{}"
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
<HEAD>
<TITLE> 404 File Not Found </TITLE>
</HEAD>
<BODY>
The URL you requested could not be found on this server.
</BODY>
</HTML>

When I actually pass the correct information via the API call, I get a meaningful result:

curl --silent --insecure -XPOST https://10.6.5.1/_IA_API/idasdk/show-identity -H "Content-Type: application/json" --data-binary "{ \"shared-secret\": \"aaaa\", \"ip-address\": \"1.1.1.1\" }"
{
"ipv4-address" : "1.1.1.1",
"message" : "total 0 user records were found."
}

CP-NDA · ‎2019-01-18

Hi Dameon,

Yes of course we did but we don't get any answer from API... We also tried to change setting On all interface to make sure but without success

I will try to reboot the gateway this weekend or open a TAC ticket

Thank you

PhoneBoy · ‎2019-01-19

No answer at all?

Maybe the firewall access policy is blocking the traffic.

Any logs?

What does tcpdump/fw monitor show?

Soeren_Rothe · ‎2021-03-31

In R81 your command didn't work for me.

This worked for me:

curl -k -H "Content-Type: application/json" -d $'{"shared-secret":"aaaaaaa",\n "ip-address":"192.168.1.11"}' https://192.168.0.1/_IA_API/v1.0/show-identity

[root@lnx ~]# curl -k -H "Content-Type: application/json" -d $'{"shared-secret":"aaaaaaaa",\n "ip-address":"192.168.0.11"}' https://192.168.0.1/_IA_API/v1.0/show-identity
{
   "ipv4-address" : "192.168.0.11",
   "message" : "total 0 user records were found."
}
[root@lnx ~]#

Are you a member of CheckMates?

R80.20 Identity Awareness API