topic Re: Add Device Authentication Failure in Expedition Discussions

Add Device Authentication Failure

UNMPDgordon — Tue, 29 Nov 2022 22:36:34 GMT

More of an advice posting than a request for assistance.

Do not make your PA firewall admin password really crazy long and complex (like I did ~ at 19 characters long).

If you do, you might get tripped up by Expedition when you try and add a device and the user API keys.

Background:

New PA-440 Firewall (FW)

Stood up Expedition VM on Monday the 21st.

I kept getting "Invalid Credential" in Expedition when trying to add the API key for admin with my crazy long complex pwd.

I was able to SSH from the Ubuntu Server to the FW using admin with its 19-character long password so was greatly puzzled why Expedition was bombing out. Even opened a case on PA support. Lots of inconclusive results found.

After a zoom session a short time ago with my local PA VAR and a SE with PA, I found a clue to a possible solution in the /home/userSpace/devices/debug.txt file: only part of that long booger of a pwd was being transmitted to the FW so of course(!) authentication is going to fail! As an aside, I find it curious that the pwd used is in clear text in the debug.txt file!

After changing my FW admin pwd to something that _just_ meets the security requirements (8 long, one cap, 5 lower and 2 bangs), committing, signing out of everything, signing back into Expedition, adding my device and using the shorter admin pwd, the add succeeded and the 3 keys were populated!

Re: Add Device Authentication Failure

M.Anderson — Fri, 20 Jan 2023 21:44:54 GMT

I'm running into the same issue. PWD = 9 characters, upper case, lower case, number, special character #

Any recommendations?

Re: Add Device Authentication Failure

lychiang — Fri, 20 Jan 2023 22:32:32 GMT

@M.Anderson Try to remove the special character and try again, if it's still not working, you can try create a new user account on the firewall and assign the API read permission.

Re: Add Device Authentication Failure

M.Anderson — Tue, 24 Jan 2023 17:20:09 GMT

I did both. Added a new user account with API read permissions, as well as removing the special character. Thank you sir!

Re: Add Device Authentication Failure

AnthonyPacheco — Tue, 16 Jan 2024 15:35:23 GMT

any resolution to this? I've tried username/password, api login, removal of special characters, etc

Re: Add Device Authentication Failure

dpuigdomenec — Tue, 16 Jan 2024 17:05:33 GMT

Hi @AnthonyPacheco

Try to execute the external command and later in Expedition create the device and add directly the created API_KEY

curl -H "Content-Type: application/x-www-form-urlencoded" -X POST https://firewall/api/?type=keygen -d 'user=<user>&password=<password>'

Reference article: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-panorama-api/pan-os-api-authentication/get-your-api-key

Hope this helps,

David