topic Re: Revoke XML API key for a specific user who is configured on radius server. in Automation/API Discussions

Revoke XML API key for a specific user who is configured on radius server.

rirani — Fri, 16 Dec 2016 01:19:28 GMT

Hi,

I would like to revoke a xml api key for a specific user who is configured on radius server .

Changing the password on the radius server doesnt revoke the old api key of the user.

Firewall is still athenticating the user using old api key.

Is there anyway of revoking api key of a specific user on palo alto firewall ?

Note : this specific user is an admin user with the help of api he is able to authenticate and get access of the firewall.

Re: Revoke XML API key for a specific user who is configured on radius server.

cpainchaud — Mon, 19 Dec 2016 19:35:11 GMT

API keys are encrypted version of login+password , so they cannot be revoked , you need to change the password.

I could be wrong but after cache dies ( a few minutes/hours ) then the api key should not work anymore

Re: Revoke XML API key for a specific user who is configured on radius server.

rirani — Tue, 20 Dec 2016 08:27:38 GMT

We changed the password on the Radius server but still the firewall authenticates the admin user with the old key. Changed password on the Radius server also didnt help in our situation.

Re: Revoke XML API key for a specific user who is configured on radius server.

cpainchaud — Fri, 23 Dec 2016 12:37:37 GMT

this is really weird , I would open a TAC case