topic Re: Use XML API users in policies in General Topics

Use XML API users in policies

tsauter — Sun, 17 Feb 2019 19:25:32 GMT

Hallo,

I successfully configured an WLAN-Accesspoint to send users via the xml api.
I can see the users in the log entries but I cannot select the users in particular policies. Looks like the users are not known to the firewall.

Do I need to create local users with the same username? Or how can one use these submitted users in policies?

Thank you.

Regards

Re: Use XML API users in policies

reaper — Tue, 19 Feb 2019 10:59:11 GMT

Will also need to configure the user identification on the firewall, so policies can be applied

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRyCAK

Re: Use XML API users in policies

tsauter — Tue, 19 Feb 2019 12:00:15 GMT

Hello,

thanks for the answer. I read through the KB entry, but I couldn't found how the system learn the users so I can use them in the policy. If I understood correctly, the user agent sync the users between the directory service and the firewall.

But in the case of the XML api there is no user agent available.

Should I just manually create the users? Do the firewall match them together?

Thanks.

Re: Use XML API users in policies

reaper — Tue, 19 Feb 2019 14:46:54 GMT

in your case you dont need the user agent as you're feeding the system with the API, the rest of the config helps you add groups so you can add these to the policy (only groups are autopopulated, and are easier to use than usernames)

else you will need to type the username manually