Hi,
I'm testing a draft workflow that modifies a user's attributes in Duo using the Duo Admin API and based on the "Duo - Admin - Add User to Group" atomic. Currently it just modifies user's notes:
When I use spaces in the notes parameter, it fails the workflow.
The workflow passes when there are no spaces (no characters to encode). Per the Hints in HTTP Request | SecureX orchestration (ciscosecurity.github.io), I think I already created the payload in an "Execute Python Script" block. But the payload is just text (notes=Some%20notes%20to%20add) not JSON. How do deal with encoded characters in the request body? I tried surrounding the [params_encoded$] in quotes but to no avail.
However, it works just fine in Python:
import requests
method = 'POST'
host = 'api-XXXXXXXX.duosecurity.com'
path = '/admin/v1/users/XXXXXXXXXXXXXX'
params = {'notes': 'Some notes to add'}
skey=<key>
ikey=<ikey>
c = canon(
method=method,
host=host,
path=path,
params=params
)
#print(c)
urlPath = c[-2]
pathParm = c[-1]
print(pathParm)
headRequest = signHeader(
method = method,
host = host,
path = path,
params = params,
skey=skey,
ikey=ikey)
headRequest['Host'] = host
headRequest['Content-Type'] = 'application/x-www-form-urlencoded'
response = requests.request(method=method,
url=url,
headers=headRequest,
data= pathParm)
print(response.status_code)
notes=Some%20notes%20to%20add
200
Thanks!
Thanks @chrivand .
I am using the "Duo - Admin - Add User to Group" atomic as a guide for my workflow. The payload for the POST request needs to be formatted as URL-encoded key-value pairs (the same request format used by browsers to submit form data), Duo Admin API | Duo Security
EXECUTE PYTHON SCRIPT Generate Request Parameters
Outputs the j variable {"group_id":"XXXX"} to params variable.
EXECUTE PYTHON SCRIPT Generate Request Signature
Takes the params variable and outputs it as group_id=XXXX to the params_enc variable.
HTTP REQUEST Execute Duo API Call
Take the params_enc for the request body. This API call will fail in my workflow (to modify a user's notes) when the payload contains encoded characters (notes=Some%20notes%20to%20add). If the payload lacks any encoded characters, it works (notes=NoSpaces).
Fortunately, changing my workflow to alter a user's Duo status back to active works (status=active for the POST request body). Just curious if there is a workaround for an URL-encoded key-value pairs payload should I want to change a user's notes, name, or any other attribute that could possibly contain spaces or other special characters. Tried fumbling with a straight Python block to send the POST request.
Thanks again. I got it working when using multiple request parameters (notes and email) via Python Script blocks.
EXECUTE PYTHON SCRIPT Generate Request Parameters
import sys,json
(notes,email) = sys.argv[1:]
d = {}
d["notes"] = notes
d["email"] = email
j = json.dumps(d)
Execute Python POST API Request
import base64, email.utils, hmac, hashlib, urllib, requests, json, sys
# Sign Headers function
def signHeader(method, host, path, params, skey, ikey):
"""
Return HTTP Basic Authentication ("Authorization" and "Date") headers.
method, host, path: strings for request
params: dict of request parameters
skey: secret key
ikey: integration key
"""
# create canonical string
now = email.utils.formatdate()
canon = [now, method.upper(), host.lower(), path]
args = []
for key in sorted(params.keys()):
val = params[key].encode("utf-8")
args.append(
'%s=%s' % (urllib.parse.quote(key, '~'), urllib.parse.quote(val, '~')))
canon.append('&'.join(args))
canon = '\n'.join(canon)
# sign canonical string
sig = hmac.new(bytes(skey, encoding='utf-8'),
bytes(canon, encoding='utf-8'),
hashlib.sha1)
auth = '%s:%s' % (ikey, sig.hexdigest())
# return headers
return {'Date': now, 'Authorization': 'Basic %s' % base64.b64encode(bytes(auth, encoding="utf-8")).decode()}
# canonization function
def canon(method, host, path, params):
"""
Returns a list of the five-line request.
method, host, path: strings for request
params: dict of request parameters
"""
# create canonical string
now = email.utils.formatdate()
canon = [now, method.upper(), host.lower(), path]
args = []
for key in sorted(params.keys()):
val = params[key].encode("utf-8")
args.append(
'%s=%s' % (urllib.parse.quote(key, '~'), urllib.parse.quote(val, '~')))
canon.append('&'.join(args))
return canon
#POST Request
(method, host, path, params, skey, ikey) = sys.argv[1:]
method = method
host = host
path = path
params = json.loads(params)
skey = skey
ikey = ikey
c = canon(
method=method,
host=host,
path=path,
params=params
)
urlPath = c[-2]
pathParm = c[-1]
headRequest = signHeader(
method = method,
host = host,
path = path,
params = params,
skey=skey,
ikey=ikey)
headRequest['Host'] = host
headRequest['Content-Type'] = 'application/x-www-form-urlencoded'
url = f"https://{host}{urlPath}"
response = requests.request(method=method,
url=url,
headers=headRequest,
data= pathParm)
print(response.status_code)
