Ivanti Neurons for Zero Trust Access Use Case

this chapter of the document will provide code snippets for different api call which can help tenant admins to configure secure access policy these steps involve authenticating the api then adding all required components including user and user rules and finally configure secure access policy using all the other components steps automated in example use case preparing to configure the nzta system, see preparing to configure the system docid\ l57zcvyzgivv8r cqnig5 adding a gateway, see adding a zta gateway docid\ l57zcvyzgivv8r cqnig5 adding an application, see adding an application docid\ l57zcvyzgivv8r cqnig5 adding a device rule and device policy, see adding a device rule and policy docid\ l57zcvyzgivv8r cqnig5 adding an auth server, see adding an authentication server docid\ l57zcvyzgivv8r cqnig5 adding a user (local user), see adding a local user docid\ l57zcvyzgivv8r cqnig5 adding a user rule, see adding a user rule docid\ l57zcvyzgivv8r cqnig5 adding a user rule to a group, see adding a user rule docid\ l57zcvyzgivv8r cqnig5 adding a secure access policy, see adding a secure access policy docid\ l57zcvyzgivv8r cqnig5 preparing to configure the system this section explains how to prepare to configure the nzta system using its rest api the following python modules needs to be imported to enable the code snippets in this chapter import requests import json the following parameters are required to enable the code snippets in this chapter sslcertverify = false apiheaders = {'content type' 'application/json', 'accept' 'application/json'} headers = {"content type" "application/json"} user name = 'admin' passwrd = 'admin password' api version = 'api/v1/' api = 'api/' host url = 'https //\<tenant domain name>/' cookies = {"dsid" ""} you can use the following curl command format uses the dsid to query the rest api server curl v cookie "dsid=\<value>" \<api request url> adding a zta gateway adding a gateway involves multiple api calls, including getting city id and using that to add the gateway you can then get the gateway id to enable gateway configuration def add gateways() ''' get country code to get the city id which is one of the parameters needed for adding gateway ''' get country code url = host url + api + "locations/countries" country list = requests get(get country code url,cookies=cookies) country list json = country list json() country id = "241" for country details in country list json\["items"] if country details\["country"]\["name"] == "united states" country id = country details\["country"]\["id"] \# one we get the country id use that id to get the list of cities with respective id, following request will illustrates process of getting city id state id = "3512" get state code url = host url + api + "locations/states?country="+str(country id) state code json = requests get(get state code url,cookies=cookies) state list json = state code json json() for state details in state list json\["items"] \#print state details if state details\["state"]\["name"] == "california" state id = state details\["state"]\["id"] \# following api call is get the city id using country and state id which are retrived from previous two calls this logic will filter for san jose city to get the city id get city code url = host url + api + "locations/cities?country="+str(country id)+"\&state="+str(state id) city list = requests get(get city code url,cookies=cookies) city list json = city list json() city id="12631" for cities in city list json\["items"] if cities\["city"]\["name"] == "san jose" city id = cities\["city"]\["id"] \# following step will help us add a gateway to controller using api call input gateways = {"name" "gw4","orchestration" {"type" "vsphere"}} gateway location = {} gateway location\["city id"] = city id input gateways\["location"]=gateway location \# input gateways variable input all the required parameters such as gateway name, orchestration type and city id for gateway api which is post method request uri = host url + api + "gateways" output = requests post(request uri, data=json dumps(input gateways), cookies=cookies, headers=headers) status code = output status code response json = output json() print response json gateway id=response json\["id"] input data='{"service account id"\ none,"appliance config" {"external gateway" "192 168 114 251","external ip address" "192 168 14 11","external subnet" "255 255 255 0","external vlan" " 1","internal fqdn" "","internal gateway" "172 96 14 1","internal ip address" "172 96 14 60","internal subnet" "255 255 255 0","internal vlan" " 1","management gateway" "172 96 14 1","management ip address" "172 96 14 61","management subnet" "255 255 255 0","management vlan" " 1","primary dns" "142 21 0 15","private domain name" "psecure net","secondary dns" "8 8 8 8","dns search domain" "psecure net","public ip address" "192 168 14 11",},"deployment config"\ none,}' request uri = request uri + "/" + gateway id + "/" + "orchestration" print request uri output = requests post(request uri, data=json dumps(input data), cookies=cookies, headers=headers) print output json adding an application to add an application, use a policies/resources api call with the type set to "application" for example def add application() input data = {"type" "application","name" "app1","description" "app1","app config" {"access type" "application","name" "app1","resource" "https //www intuit com","resource type" "url","bookmark config" {"name" "app1","type" "web","description" "app1","launch window"\ true,"url" "https //www intuit com","icon" ""}}} add application url = host url+api version+"policies/resources" print add application url add application output = requests post(add application url,data=json dumps(input data),cookies=cookies, headers=headers) print add application output text output for this code is below { "allow delete" true, "app config" { "access type" "application", "bookmark config" { "description" "app1", "icon" "", "id" "3ddf5e1b0d35d3f8ca8da7ded4f6f0a", "launch window" true, "name" "app1", "type" "web", "url" "https //www intuit com" } "id" "4899a9fe06e64316a17891fff401bc6a", "name" "app1", "resource" "https //www intuit com", "resource type" "url" } "description" "app1", "id" "4899a9fe06e64316a17891fff401bc6a", "name" "app1", "type" "application" } adding a device rule and policy create a device rule def create device rule() input data = { "name" "device rule 1", "description" "device rule 1", "network config" { "ip address" "192 168 1 1", "netmask" "255 255 255 0", "mode" "allow" }, "label" "moderate", "type" "network" } add device rule url = host url+api version+"policies/device policies/rules" add device rule output = requests post(add device rule url,data=json dumps(input data),cookies=cookies, headers=headers) print add device rule output text create a device policy using the device rule def add device policy2 device rule() input data = { "name" "device policy 1", "description" "device policy 1" } add policy device rule url = host url+api version+"policies/device policies/groups" add policy device rule output = requests post(add policy device rule url,data=json dumps(input data),cookies=cookies, headers=headers) print add policy device rule output text adding an authentication server create an authentication server def add local auth server() input data = { "name" "auth server 1", "type" "local", "local config" { "users" \[] } } add local auth server url= host url+api version+"policies/auth servers" add local auth server output = requests post(add local auth server url,data=json dumps(input data),cookies=cookies, headers=headers) print add local auth server output text adding a local user add a user to the local authentication server def add user authservers() \#global auth server id \# get list of auth servers auth server id = "" get authserver request uri = host url + api version + "policies/auth servers" auth servers = requests get(get authserver request uri,cookies=cookies, headers=headers) for server details in json loads(auth servers text)\["auth servers"] if server details\["name"] == "auth server 1" auth server id = server details\["id"] \# api call uses auth server id to update auth server with new user details input data = {"name" "newuser1", "full name" "newuser1", "password" "dana123"} request uri = host url + api version + "policies/auth servers" + "/" + auth server id + "/users" add user response = requests post(request uri,data=json dumps(input data),cookies=cookies, headers=headers) print add user response text update the user authentication policy to use the auth server def update user auth policy() input payload = { "type" "sign in" } auth server id = "" default user policies uri = host url + api version + "policies/resources" get default user policies response = requests get(default user policies uri,params=input payload,cookies=cookies) \# for this response we will get user policy id which for type sing in and realm zta users and update the primary auth server id value with auth server id \# get the auth server id with name auth server 1, this auth server we added in previous steps get authserver request uri = host url + api version + "policies/auth servers" auth servers = requests get(get authserver request uri,cookies=cookies, headers=headers) for server details in json loads(auth servers text)\["auth servers"] if server details\["name"] == "auth server 1" auth server id = server details\["id"] \# now update the input payload for updating user signin policy primary auth server id during the put call for user policy details in json loads(get default user policies response text)\["items"] if user policy details\["sign in config"]\["realm"] == "zta users" request uri = default user policies uri + "/" + user policy details\["id"] input data = user policy details input data\["sign in config"]\["primary auth server id"] = auth server id update user policy details output = requests put(request uri, data=json dumps(input data), cookies=cookies, headers=headers) print update user policy details output text adding a user rule create a user rule def add user rule() input data = { "name" "user rule 1", "type" "username", "value" "user rule 1", "attribute" "is" } request uri = host url + api version + "policies/role mapping rules" output add user rule = requests post(request uri, data=json dumps(intput data), cookies=cookies, headers=headers) print output add user rule text the output of this code is below { "attribute" "is", "id" "8970619481ba470c82c114a20bee3a07", "name" "user rule 1", "type" "username", "value" "user rule 1" } adding a user rule to a group create a user group of type user signin policy, and add the above user rule to the group def add user group() input payload = { "type" "sign in" } auth server id = "" default user policies uri = host url + api version + "policies/resources" get default user policies response = requests get(default user policies uri,params=input payload,cookies=cookies) user policy id = "" \# now update the input payload for updating user signin policy primary auth server id during the put call for user policy details in json loads(get default user policies response text)\["items"] if user policy details\["sign in config"]\["realm"] == "zta users" user policy id = user policy details\["id"] input data = { "name" "user group 1", "sign in policy id" "", "description" "user group 1", "rules" \[] } input data\["sign in policy id"] = user policy id request uri = host url + api version + "policies/user rule groups" output add user rule = requests post(request uri, data=json dumps(input data), cookies=cookies, headers=headers) print output add user rule text the output of this code is below { "allow delete" true, "description" "user group 1", "id" "3e99edd4e5534ca6a322a404e8c26d4a", "name" "user group 1", "role config" { "id" "612dc9de1e5148748a378742a5d2311e", "name" "user group 1", "redirect url" "/user", "type"l "user" } "role id" "612dc9de1e5148748a378742a5d2311e", "sign in config" { "id" "21ff78e93fda4b0c86e7af96dfa75680", "policy type" "user", "primary auth server config" { "id" "0a867da874cd426cbe6acd2efba149ec", "name" "auth server 1", "type" "local" } "primary auth server id" "0a867da874cd426cbe6acd2efba149ec", "realm" "zta users", "url pattern" " /login/", "use as saml idp" false } sign in policy id" "21ff78e93fda4b0c86e7af96dfa75680" } adding a secure access policy finally, publish a secure access policy using all of the above def add secure access policy() input data = { "type" "application", "resource type" "single", "user rule group id" "", "gateway type" "single", "gateway id" "", "resource id" "", "device policy id" "" } \# all values in following 4 lines derived from different api calls made in all previous examples input data\["user rule group id"] = "3e99edd4e5534ca6a322a404e8c26d4a" input data\["gateway id"] = "edb5fc9969304619b6cb976a2a6101e6" input data\["resource id"] = "4899a9fe06e64316a17891fff401bc6a" input data\["device policy id"] = "e639512d55fb47e5940d9b8053916629" request uri = host url + api version + "policies/secure access policies" output add secureaccess policy = requests post(request uri, data=json dumps(input data), cookies=cookies, headers=headers) print output add secureaccess policy text the output of this code is below { "device policy config" { "name" "device policy 1" } "device policy id" "e639512d55fb47e5940d9b8053916629", "gateway id" "edb5fc9969304619b6cb976a2a6101e6", "gateway type" "single", "id" "1b87430b470a44cda082fb638fa87ae2", "resource config" { "name" "app1" } "resource id" "4899a9fe06e64316a17891fff401bc6a", "resource type" "single", "type" "application", "user rule group config" { "name" "user group 1", "role config" { "id" "612dc9de1e5148748a378742a5d2311e", "name" "user group 1", "redirect url" "/user", "type" "user" } } "user rule group id" "3e99edd4e5534ca6a322a404e8c26d4a" }