iControl REST Remote Authentication BIG-IP v12

Hey everyone,

If someone facing this problems, there is an workaround in version 12.

You need to create the User first local on the device, after that you can use that user to make REST call's just with basic auth. So you need no Post to the login or/and an login reference.

There is a dokumentation with authentication token, but I don't managed to get this to work on an bigip (https://devcentral.f5.com/wiki/icontrol.authentication_with_the_f5_rest_api.ashx) maybe it's only for bigiq.

Regards Stefan

Ok, confirmed working on my test setup with tacacs+, no local accounts other than root/admin defined:

URL: https://172.16.44.15/mgmt/shared/authn/login 
Method: POST
Headers: Content-Type: application/json
Payload: {
    "username": "remote_user_name", 
    "password": "remote_user_password", 
    "loginProviderName": "tmos"
    }

This will result in this response:

{
username: "user_mgr"
loginReference: {
link: "https://localhost/mgmt/cm/system/authn/providers/tmos/1f44a60e-11a7-3c51-a49f-82983026b41b/login"
}-
loginProviderName: "tmos"
token: {
uuid: "28caadf8-1e03-4d6c-b978-243bbd32bf7b"
name: "29D5E8D5BAB32571805899BE18ED3E09DD1C59C55AC6479180EE3D6048F046B259DADA171F05ACD6BF035BBA3EC71A668692302277BB1035F127126965ADF3EB"
token: "29D5E8D5BAB32571805899BE18ED3E09DD1C59C55AC6479180EE3D6048F046B259DADA171F05ACD6BF035BBA3EC71A668692302277BB1035F127126965ADF3EB"
userName: "user_mgr"
user: {
link: "https://localhost/mgmt/cm/system/authn/providers/tmos/1f44a60e-11a7-3c51-a49f-82983026b41b/users/ec48bc68-323a-4fb9-80f3-e615611e091c"
}-
groupReferences: [1]
0:  {
link: "https://localhost/mgmt/cm/system/authn/providers/tmos/1f44a60e-11a7-3c51-a49f-82983026b41b/user-groups/1d0258c2-440a-3d19-a716-292b231e3190"
}-
-
timeout: 1200
startTime: "2015-11-06T12:17:24.168-0800"
address: "172.16.44.1"
partition: "[All]"
generation: 1
lastUpdateMicros: 1446841044168382
expirationMicros: 1446842244168000
kind: "shared:authz:tokens:authtokenitemstate"
selfLink: "https://localhost/mgmt/shared/authz/tokens/28caadf8-1e03-4d6c-b978-243bbd32bf7b"
}-
generation: 0
lastUpdateMicros: 0
}

Then, use the token as the value in X-F5-Auth-Token to make a request:

URL: https://172.16.44.15/mgmt/tm/ltm/pool?$select=name
Method: GET
Headers: X-F5-Auth-Token: 29D5E8D5BAB32571805899BE18ED3E09DD1C59C55AC6479180EE3D6048F046B259DADA171F05ACD6BF035BBA3EC71A668692302277BB1035F127126965ADF3EB
Payload: 

This results in a successful query with token instead of b64 encoded basic auth header:

{
kind: "tm:ltm:pool:poolcollectionstate"
selfLink: "https://localhost/mgmt/tm/ltm/pool?$select=name&ver=12.0.0"
items: [4]
0:  {
name: "REST_for_the_weary_pool"
}-
1:  {
name: "mypool"
}-
2:  {
name: "newpool"
}-
3:  {
name: "newpool2"
}-
-
}

Not sure whether anyone has seen this - https://devcentral.f5.com/wiki/iControl.Authentication_with_the_F5_REST_API.ashx?lc=1

This is bit elaborate documentation on how to obtain loginReference.

I wrote this up in article format in Demystifying iControl REST Part 6: Token-based Authentication with python examples.