Hi, here is a routine I wrote for Ansible.
It´s validating an existing token before using it for the following tasks.
In case it is already invalid or it is expiring soon, a new token will be requested and stored for future use.
I use it i.e. for device onboarding, configuration and modification tasks.
Even if you don´t use Ansible it hopefully shows the REST calls applied.
It´s tested with TMOS v12-v15.
Cheers, Stephan
- name: request current token information
no_log: "{{ logging_disabled }}"
uri:
validate_certs: no
url: https://{{ inventory_hostname }}/mgmt/shared/authz/tokens/{{ device_info[inventory_hostname].token }}
method: GET
headers:
X-F5-Auth-Token: "{{ device_info[inventory_hostname].token }}"
status_code:
- 200
- 401
register: token_info
until: (token_info.status == 200) or
(token_info.status == 401)
retries: 90
delay: 10
when: (device_info is defined) and
(device_info[inventory_hostname] is defined) and
(device_info[inventory_hostname].token is defined)
- name: debug current token
debug:
msg:
- "auth status code: {{ token_info.status | default('undefined') }}"
- "token valid for: {{ (token_info.json.expirationMicros | int - token_info.json.lastUpdateMicros | int) // 1000000 }} seconds"
- "current token: {{ device_info[inventory_hostname].token | default('undefined') }}"
when: (device_info is defined) and
(device_info[inventory_hostname] is defined) and
(device_info[inventory_hostname].token is defined) and
(token_info.status != 401)
- name: aquire new token on error or if token would expire soon
no_log: "{{ logging_disabled }}"
uri:
validate_certs: no
url: https://{{ inventory_hostname }}/mgmt/shared/authn/login
method: POST
body_format: json
body:
username: admin
password: "{{ bigip_credentials_secure.admin }}"
loginProviderName: tmos
register: token_data
until: token_data.status == 200
retries: 60
delay: 10
when: (token_info.status is not defined) or
(token_info.status == 401) or
((token_info.status == 200) and (((token_info.json.expirationMicros | int - token_info.json.lastUpdateMicros | int) // 1000000) < 120))
- name: retrieve token from payload and store to data structure
set_fact:
device_info: "{{ device_info | default({}) | combine({inventory_hostname: {'token': token_data.json.token.token, 'expiration': token_data.json.token.expirationMicros}}, recursive=True) }}"
when: (token_data is defined) and
(token_data.status is defined) and
(token_data.status == 200)
- name: debug final token
debug:
msg:
- "final token: {{ device_info[inventory_hostname].token | default('undefined') }}"
when: (device_info is defined) and
(device_info[inventory_hostname] is defined) and
(device_info[inventory_hostname].token is defined)
...
Cirrus
