REST API and NCT HTTP Error: 403

[pegore]

I am installing a fresh cluster using NCT, the NSO is installed, but cannot get the NCT REST working for package install, keep getting a HTTP403: Forbidden error

nct packages -c install --package ncs-4.4-cisco-ios-5.1.5.tar.gz -h 10.29.254.241 --rest-user root --rest-pass <passw> -v

nct_lib(810): HTTP Request = "https://10.29.254.241:8888/api/running/software/packages/_operations/install"

nct_lib(821): HTTP(403) Reply = {"HTTP/1.1",403,"Forbidden"}

Install Package at 10.29.254.241:8888

  ERROR : operation-failed - access denied

this seems like it is working:

curl -k -u <user>:<passw> https://10.29.254.241:8888/api -X GET

<api xmlns="http://tail-f.com/ns/rest" xmlns:y="http://tail-f.com/ns/rest">

  <version>0.5</version>

  <config/>

  <running/>

  <operational/>

  <operations/>

  <rollbacks/>

</api>

Any ideas would be appreciated

[Jan Lindblad]

Could you verify that you have the correct credentials (and that the password is duly quoted from the CLI interpreter) by running some other REST operation towards the system, e.g. getting the config?

[pegore]

Jan,

I am using root as credentials, I have also tried admin:admin, my own login, etc.

Depending on credentials I get not authorized, or forbidden – the last one is based on the root login.if I do an NCT Check, REST is OK.

I have created the admin group and added users to that for aaa login – I am thinking of using local auth to test that, but aaa allows me to ssh to the ncs cli.

Pete

[pegore]

With only local authentication, here is what I get with a root login:

nct packages --hostsfile hostsfile list -vv --rest-user root --rest-pass

nct_lib(810): HTTP Request = "https://10.29.254.242:8888/api/running/software/packages/_operations/list"

nct_lib(810): HTTP Request = "https://10.29.254.243:8888/api/running/software/packages/_operations/list"

nct_lib(810): HTTP Request = "https://10.29.254.244:8888/api/running/software/packages/_operations/list"

Package Info at 10.29.254.241:8888

HTTP(401) - Unauthorized

[Jan Lindblad]

And do you have any NACM rules installed in NSO that allows access from root/admin/... ? If you have a "system install" NSO, you need to configure NACM to allow them yourself.