Check_mk REST-API apache authentication

[ghassan]

Hi,

I am trying to rewrite our our monitoring hook which uses the WEB-API for multiple host operations, to use the REST-API instead, it looks straight forward, our check_mk master is running behind an apache reverse proxy with AD authentication, with the WEB-API it was sufficient to use auth=(user, password) in the API request.

So basically the following example from the REST-API documentation doesn’t work:

#!/usr/bin/env python3
import pprint
import requests

HOST_NAME = "localhost"
SITE_NAME = "production"
API_URL = f"http://{HOST_NAME}/{SITE_NAME}/check_mk/api/1.0"

USERNAME = "automation"
PASSWORD = "test123"

session = requests.session()
session.headers['Authorization'] = f"Bearer {USERNAME} {PASSWORD}"
session.headers['Accept'] = 'application/json'

resp = session.post(
    f"{API_URL}/domain-types/host_config/collections/all",
    headers={
        "Content-Type": 'application/json',  # (required) A header specifying which type of content is in the request/response body.
    },
    json={
        'folder': '/',
        'host_name': 'example.com',
        'attributes': {
            'ipaddress': '192.168.0.123'
        }
    },
)
if resp.status_code == 200:
    pprint.pprint(resp.json())
elif resp.status_code == 204:
    print("Done")
else:
    raise RuntimeError(pprint.pformat(resp.json()))

I tried different ways, session.auth, payload in the request and even the auth=(user, password), unfortunately none of them worked. Any idea how can I make the authentication work?

Thanks

[ghassan]

The only way I found to work around this is by whitelisting the network in the Apache LDAP Auth from which the API requests are done.