REST API authorization in a cronjob, recommendation

Question

I'd like to run an automatic script via cronjob to trigger REST API calls on a BIG-IQ (the script is located on the BIG-IQ itself).
What possibilities are available in regards to authorization, especially from a security point of view, meaning avoiding placing credentials in the script. Is there maybe an option to use mutual SSL as trust?
Right now doing manual testing I first create a token with basic credentials and then doing the REST-call with this token.
But having an automatic script, there is no posibility to enter the password, means it needs to be placed somewhere.
Any ideas would be very helpful.
Thank you!

Regards Stefan 🙂

nikoolayy1 · Answer

Better check the security things for Linux curl as there are some ways like netrc files or using environmental variable for user:pass.
&nbsp;
https://linuxhint.com/curl-username-password/
&nbsp;
https://www.googlecloudcommunity.com/gc/Cloud-Product-Articles/Do-you-use-curl-Stop-using-u-Please-use-curl-n-and-netrc/ta-p/75724
&nbsp;
Outside of that make a new user with the correct role to limit what the script can do
&nbsp;
https://techdocs.f5.com/kb/en-us/products/big-iq-centralized-mgmt/manuals/product/big-iq-centralized-management-authentication-roles-and-user-management-6-1-0/05.html

stefan_klotz · Answer

Thanks&nbsp;Nikoolayy1&nbsp;, sound promising. And from what I read so far this also works automatically with requests-function in python. But can I also put the credentials into variables to use it somewhere else other then in the Basic Authorization header? I'm asking, because the credentials need to be included in the json-body of the token-request and not as part of the Authorization header.Regards Stefan 🙂

nikoolayy1 · Answer

I have not done it in a json body but there seems to be examples on the Internet like:
&nbsp;
https://towardsdatascience.com/proper-ways-to-pass-environment-variables-in-json-for-curl-post-f797d2698bf3

Forum Discussion

REST API authorization in a cronjob, recommendation

Recent Discussions

Blocking client that uses existing cookie

APM Import error: config version 15.1 is not compatible with BIGIP version 16.1

About Customized AWAF Rules

Cookie not RFC-compliant - Cookie has no value

F5 Next - how to reference irule procedures

Related Content

JWT authorization with NGINX Ingress Controller

OWASP Tactical Access Defense Series: Broken Function Level Authorization (BFLA)

iRule - Authorization Bearer / Basic

Resolve Citrix Secure Ticket Authority (STA)

OWASP Tactical Access Defense Series: Broken Object Property Level Authorization and BIG-IP APM