code 403 while deleting a device via IMC API

[pioter00]

Hi,

I'm getting 403 error code trying to delete a device via IMC API. Code in python:

import requests
import json
from requests.auth import HTTPDigestAuth
url = 'http://imc_host:8080/imcrs/plat/res/device/11751/delete'
response = requests.delete(url, auth=HTTPDigestAuth('admin', 'password'), headers={ 'Accept': 'application/json'} )
print(response.status_code)

returns 403 (Forbidden).

There is no problem to delete a device via GUI as the same user (admin). "admin" is in "Administrator Group".

There is no problem to download device data with "get" method as the same user and password:

import requests
import json
from requests.auth import HTTPDigestAuth
url = 'http://imc_host:8080/imcrs/plat/res/device/11751'
response = requests.get(url, auth=HTTPDigestAuth('admin', 'password'), headers={ 'Accept': 'application/json'} )
print(response.status_code)

returns 200.

Why am I getting 403 when deleting ?

Regards

P.S.

[jguse]

Hello,

I tested the exact same code for deleting a device via API, except adjusting the URL and password to match my IMC install. It worked just fine, deleting the device with the ID I had requested and returning 204 status code.

Based on your error, it sounds like the credentials are wrong, though it's strange that the GET worked. Or perhaps your device ID is incorrect? Are you sure the Device ID is 11751? You could check this with the GET method you mentioned, or via /imcrs API interface.

Do you get the same error code when you enter the device ID on there under /plat/res/device/{id}/delete and "Try it out"?

Other than that, I guess it could be a bug in your IMC version, though I haven't heard of such issue before. I'm running iMC 7.3 E0705P06 where I tested your code.

[pioter00]

Hello,

 Device ID 11751 exists. I can get via API all  data of the device with ID 11751. I didn't write print(response.json()) in above get example, but all data are downloaded and printed. The problem is with deleting any device, not only with device ID 11751. And only via API, I can delete it using GUI.

We have IMC v.7.1. E0303P16.

I am not sure if there is any need to set or check permissions somewhere  that can cause this effect.

Do you get the same error code when you enter the device ID on there under /plat/res/device/{id}/delete and "Try it out"?

I do not know what you mean. I do enter the device ID under /plat/res/device/{id}/delete:

         http://imc_host:8080/imcrs/plat/res/device/11751/delete

[jguse]

Hello,

I was asking about device ID 11751 since that's quite a large number, and while iMC doesn't necessarily assign IDs in order of 1, 2, 3 etc., it seemed like an unusually large number for a device ID.

Sounds like it could be a permission issue... are you using the default "admin" operator, or a different one? I'd try it with the default admin if you haven't already, as this one should have all the permissions.

If you use an operator in an Operator Group with customized permissions, make sure it is an Administrator-level group (Maintainer/Viewer cannot be assigned API access) and has permissions for System - Resource Management > Resource Management > Delete Device and System - Resource Management > RESTful Web Services Call. This is configured when you add/modify a non-default Operator Group under the "Operation Privileges" options.

As for the "imcrs", I am referring to the swagger UI that IMC provides when you access your system with http://imc_host:8080/imcrs/ (and login with your operator). This UI is really useful to see all the API functions available and how they can be queried, and also has a button "Try it out!" on each API function that allows you to test it. I wonder if you receive the same error when you try that delete on the /plat/res/device/{id}/delete page.

[pioter00]

Hello,

Yes, I'm using the default "admin" operator, a member of the default "Administrator Group" with Privilege ADMIN.

I tried already to test with another operator with explicity set permissions for System - Resource Management > Resource Management > Delete Device and System - Resource Management > RESTful Web Services Call.. The result is the same.

You're right, "imrs" is a pretty cool UI. But the result is the same:

HTTP Status 403 - Forbidden 

Access to the specified resource has been forbidden

Best regards 

PS

[jguse]

Hello,

One more thing that comes to mind - is your eAPI licensed? If you go to the top right corner in the GUI -> About window, do you see: Extended integration API(eAPI):Authorized

If you can't progress otherwise, I'd suggest doing an upgrade and seeing if the issue persists. If so, I would suggest opening a support case so we can take a proper look at this.

[pioter00]

Hello,

And actually: "Extended integration API(eAPI):Unauthorized". 

I was convinced that the API module was included in IMC SE.

Best regards

PS

[jguse]

Hello,

Considering you are running a 7.1 version of IMC, that may be part of the issue. There is some conflicting information out there about Standard edition and whether or not it supports eAPI without an additional license, but I believe support was integrated into the platform license at some point in the past.

My IMC 7.3 Standard installs in the lab all show eAPI as Authorized despite not having applied a license specifically for this feature. Maybe you could try upgrading to the latest version and see if that fixes it?

If it persists, a license refresh might help too. There is a tool included at least in newer versions, iMC\client\bin\snregen.bat (or .sh) which can be executed as Admin/Root to generate a new Serial Number for your IMC server. Then you can transfer the license on the My Networking portal to the new SN and apply it to IMC, restart the software, and check if that activated eAPI.

In case you cannot transfer the license yourself, please open a support case. License-related cases are always supported regardless of whether you have a support contract or not.

[pioter00]

Hello, 

There is snregen.bat file in IMC\client\bin directory. If I execute this file and problems arise with the licence transfer, it may take some time to resolve them with HP support. Will IMC be fully functional at ths time ?

I am trying to assess the risk of such an operation.

Best regards

PS

[jguse]

Hello,

Executing the snregen.bat will generate a new serial number in iMC, which will invalidate your current license until it is transferred to the new SN and applied to iMC.

Every iMC license can be transferred by the owner up to two times, so you could theoretically do this yourself on the My Networking license portal. Alternatively you'd need to contact HPE Support. If you do, make sure you specify that you need a license transfer, and provide:

* The e-mail address of the account where the licenses are located

* The old Serial Number (the one your iMC current uses)

* The new Serial Number, generated after running snregen.bat

Providing these details will ensure your transfer happens as efficiently as possible.

Alternatively you could migrate iMC, which would ensure your old system remains up and running until the new one can be licensed.

[pioter00]

Hello,

One more question: will IMC server need access to the internet during the license transfer, in particular to HP websites. Our server is isolated from the internet now.

Best regards 

PS

[jguse]

Hello,

iMC does not need internet access for license transfers nor in general. The only feature you would need internet access for is the LiveUpdate and Device Registration on the web.