topic ISE REST API - modify InternalUser identityGroups in Network Access Control

ISE REST API - modify InternalUser identityGroups

dlavor — Wed, 28 Apr 2021 12:29:46 GMT

Hi,

I need to modify InternalUser identityGroups field via REST API but looks Im missing something. If I send JSON e.g.

{
    "InternalUser": {
        "id": "<uid>"
        "identityGroups": "<gid>,<gid>"
    }
}

I get 200 response

{
    "UpdatedFieldsList": {
        "updatedField": []
    }
}

with no changes at all. How can I change user's groups?

Re: ISE REST API - modify InternalUser identityGroups

balaji.bandi — Wed, 28 Apr 2021 08:20:21 GMT

here is the reference for modification :

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/216543-ise-identity-group-user-creation-and-mo.html#anc5

Re: ISE REST API - modify InternalUser identityGroups

dlavor — Wed, 28 Apr 2021 08:36:11 GMT

"identityGroups": "<ID of Identity Group, which user will be part of and can be received as described in step 2>"

Thats exactly what I am sending. Works fine for creation, group is assigned correctly but not when sending modify request. I believe it might be a bug. Using ISE 2.7.0.356

Re: ISE REST API - modify InternalUser identityGroups

Mike.Cifelli — Wed, 28 Apr 2021 12:02:12 GMT

Not sure if I have all the info, but it seems that you are missing required fields in your payload. If you look at the online SDK via https://<isepan>:9060/ers/sdk# you can see examples + required syntax for certain API consumption. Based on that to modify (update) and internal user's identity group it looks like the json payload should be like this:

{
  "InternalUser" : {
    "id" : "036f1cd7-560f-4f27-897d-1374efbb36d0",
    "name" : "name",
    "description" : "description",
    "enabled" : true,
    "email" : "email@domain.com",
    "password" : "password",
    "firstName" : "firstName",
    "lastName" : "lastName",
    "changePassword" : true,
    "identityGroups" : "identityGroups",
    "expiryDateEnabled" : false,
    "expiryDate" : "2016-12-11",
    "enablePassword" : "enablePassword",
    "customAttributes" : {
      "key1" : "value1",
      "key2" : "value3"
    },
    "passwordIDStore" : "Internal Users"
  }
}

Good luck & HTH!

Re: ISE REST API - modify InternalUser identityGroups

dlavor — Wed, 28 Apr 2021 12:22:49 GMT

I removed those fields on purpose because they are not relevant. There are only few required ones (name, id, changePassword and enabled) according to SDK.

Anyway, here is my test payload

{
    "InternalUser": {
        "id": "fcc9cdb1-9409-459c-81b5-e91d80d67062",
        "name": "test1",
        "description": "test1 desc",
        "enabled": true,
        "email": "test1@mail.com",
        "firstName": "test1 Name change",
        "lastName": "test1 Last Name",
        "changePassword": false,
        "identityGroups": "a1740510-8c01-11e6-996c-525400b48521",
        "expiryDateEnabled": false,
        "customAttributes": {},
        "passwordIDStore": "Internal Users"
    }
}

and again no luck

{
    "UpdatedFieldsList": {
        "updatedField": [
            {
                "field": "firstName",
                "oldValue": "test1 Name",
                "newValue": "test1 Name change"
            }
        ]
    }
}

Note that the test user does not have a group yet. GET response

{
    "InternalUser": {
        "id": "fcc9cdb1-9409-459c-81b5-e91d80d67062",
        "name": "test1",
        "description": "test1 desc",
        "enabled": true,
        "email": "test1@mail.com",
        "password": "*******",
        "firstName": "test1 Name change",
        "lastName": "test1 Last Name",
        "changePassword": false,
        "expiryDateEnabled": false,
        "enablePassword": "*******",
        "customAttributes": {},
        "passwordIDStore": "Internal Users",
        "link": {
            "rel": "self",
            "href": "https://192.168.127.150:9060/ers/config/internaluser/fcc9cdb1-9409-459c-81b5-e91d80d67062",
            "type": "application/json"
        }
    }
}

Re: ISE REST API - modify InternalUser identityGroups

Marcelo Morais — Wed, 28 Apr 2021 12:33:02 GMT

Hi @dlavor

an example that works:

{
  "InternalUser" : {
    "id" : "91234567-7123-4123-b123-2123456789ab",
    "name" : "marcelo_morais",
    "description" : "Internal Account",
    "enabled" : false,
    "firstName" : "Marcelo",
    "lastName" : "Morais",
    "changePassword" : false,
    "identityGroups" : "a1234567-8123-1123-9123-5123456789ab,a7654321-8321-1321-9321-5ba987654321",
    "expiryDateEnabled" : false,
    "customAttributes" : { },
    "passwordIDStore" : "Internal Users"
  }
}

the result:

{
  "UpdatedFieldsList" : {
    "updatedField" : [ {
      "field" : "identityGroups",
      "oldValue" : "[a1234567-8123-1123-9123-5123456789ab]",
      "newValue" : "[a7654321-8321-1321-9321-5ba987654321, a1234567-8123-1123-9123-5123456789ab]"
    } ]
  }
}

Hope this helps !!!

Re: ISE REST API - modify InternalUser identityGroups

dlavor — Wed, 28 Apr 2021 12:40:02 GMT

Well then it looks I have a trouble with my installation. Which version do you use?

Re: ISE REST API - modify InternalUser identityGroups

Marcelo Morais — Wed, 28 Apr 2021 14:56:33 GMT

Hi @dlavor,

ISE 2.7 P3.