API not working with user ldap and local

[phan-van-thuy]

I have a problem using GET API servicepool, when use call API with user admin them get info on service pool success, But when performing with a local user with admin rights, it fails and reports error 403.

it user of me

login using user

and when get API from this user then error "API Error: 403 Client Error: Forbidden". However, when using admin user to get it, it works normally.
So what is the problem here, is there a problem with permissions or is openuds not allowing any user other than admin (root) to use the API?

[openuds-ru]

Hi, seems like you working heavy with API, maybe you will find our library is helpful for you:

https://gitflic.ru/project/openuds/hostvmlib-openuds

Its non official, but may be useful.

[dkmstr]

All users, on UDS, should be part of a group to be allowed to login into UDS. So, if you create an user even with admin privileges, but do not make it part of any gruop, you will not be able to login. This also apply for any other authenticator. (OF course, for "external" auths as LDAP, etc.. you should first create the group inside UDS, and the user must belong to that group in the autjenticator, as LDAP, etc..)

Give a try to the client api from the openuds-ru team, it may help you :)

[phan-van-thuy]

I know that, my user is in a group, and I can login to the uds website with this user, even from this user I have full rights on the Service Pool. However, when I use this user to get the API information of the pool, there is a notification about permissions. Do you know why?

This is the image I logged in from the user adminovdi with the role:Admin I created

[phan-van-thuy]

@openuds-ru Thank you for your interest, however I am having problems with user permissions when using the API, my user is in role: Admin and can log in from the website and has permissions on all pools, but when GET API there is an error 403 message

[dkmstr]

maybe the uds.log give some clue, that API is the same that is used from admin, so it's very strange.. (That is, the admin interface use that REST API, so if you can log in into the Admin interface, the REST api has no problem, but maybe something on the headers of your request).

Anyway, if you need help with anything, please post the complete guide to reproduce the error, step by step. It's a nonsense not to do it this way :(.

Hope that helps.

[phan-van-thuy]

yes i found a solution for API, users outside admin (default user) working with API need auth_methods (authentication name) and when i POST or GET information in OpenUDS it will authenticate based on this authentication type. To solve this i had to add auth in and it worked.