Use Cisco FMC API to create user

[Difan_Zhao]

Hi team,

I am trying to create a user with the API. I can't find the scheme for the payload data with the api-explorer. I have tried different payload data like the following one without success... I am using Postman. The URL I used is {{url}}/api/fmc_config/v1/domain/{{domainUUID}}/users/users. I can pull users.

{
    "type": "User",
    "username": "testuser",
    "roles": [
        {
            "name": "Administrator",
            "id": "xxxx-xxx-xx-xxx-xxxxxx",
            "type": "AuthRole",
        }
    ],
    "email": "xxx@xxx.com",
    "enabled": true
}

I am getting this error:

{
    "error": {
        "category": "OTHER",
        "messages": [
            {
                "description": "Wildcard string cannot be null or empty. Make sure permission strings are properly formatted."
            }
        ],
        "severity": "ERROR"
    }
}

 Would appreciate it if you could point out where I did wrong. Thanks!

[Marius Gunnerud]

What version FMC are you running?

From what I can see in FMC 7.4.2.2 there is no option to create a user using API, you are only able to "GET" information about users.

[Difan_Zhao]

Hi Marius, I am on Version 7.4.2.1 (build 30). I didn't see it in the API explorer too and I was hoping that it is merely just missed... Could you confirm that this is not a supported feature? Besides API, is there another way to do bulk user creation? Thanks!

[Marius Gunnerud]

As of FMC version 7.7 there is no option to add users via API.  So the only way to add local users is through the GUI.  Optionally integrate the FMC with a remote authentication server...i.e. AD.

•  GET authroles
•  GET duoconfigs
•  PUT duoconfigs
•  GET SSO Config
•  PUT SSO Config
•  GET users

https://www.cisco.com/c/en/us/td/docs/security/firepower/770/API/REST/secure_firewall_management_center_rest_api_quick_start_guide_770/Objects_In_The_REST_API.html#Cisco_Concept.dita_f634c54c-ad6e-425b-b33a-181d21e69f5e

[Difan_Zhao]

Hi Marius, I am actually trying to create remote users and not local ones. We use the Cisco ISE as the remote authentication server and we use Radius as the protocol because it is the only one supported. However, as far as I know, you still need to create individual users, check box "Use External Authentication Method", and assigna roles... I have attached a screenshot for what we usually do with the GUI. Is there a better way to do that? Thanks!