Authentication
Authentication methods for the OpsCenter REST API depend on the configured authentication strategy.
For password-based and LDAP authentication, clients authenticate using /login session tokens.
For OpenID Connect (OIDC) / OAuth 2.0 authentication, clients authenticate using JWT bearer tokens. For more information, see Access the REST API with bearer tokens.
POST /login
Start an OpsCenter session. You must use an authentication method that submits a username and password to the login page. For example:
curl -X POST 'http://localhost:8888/login' \
-d '{"username":"admin","password":"test"}'For SSL encrypted connections, include the -k option and specify the client certificate and key using --cert and --key options:
curl -X POST 'https://localhost:8443/login' \
-k --cert /var/lib/opscenter/ssl/opscenter.pem \
--key /var/lib/opscenter/ssl/opscenter.key \
-d '{"username":"admin","password":"admin"}'Returns a JSON object with a token for the session.
This token can be passed as an opscenter-session header to authenticate future requests in the session.
A cookie for the same purpose is also set for clients that support them.
For examples, see GET /logout and User administration methods.
{"sessionid": "d6c5e198b9b5ffeab9fd8dea6fb012aa"}GET /logout
End an OpsCenter session using the opscenter-session token:
curl -X GET 'http://localhost:8888/logout' \
-H 'opscenter-session: 1948fa886a91a1905a29192cf209114d'User administration methods
In the user administration methods, the opscenter-session value is the session token returned by POST /login.
GET /permissions/user
Get a map of permissions for the currently authenticated user.
Returns a JSON object with a mapping of permissions for every cluster.
Example:
curl http://127.0.0.1:8888/permissions/user \
-H 'opscenter-session: 12345ABC'Output:
{"Test_Cluster": {"View Cluster": true}}GET /permissions/roles
Get a list of all roles in OpsCenter (requires permissions).
Example:
curl http://127.0.0.1:8888/permissions/roles \
-H 'opscenter-session: 12345ABC'Output:
{"roles": ["user"]}GET /permissions/roles/ROLE_ID
Get all permissions for a specific role.
Example:
curl http://127.0.0.1:8888/permissions/roles/test_role \
-H 'opscenter-session: 12345ABC'Output:
{"Test_Cluster": {"View Cluster": true}}PUT /permissions/roles/ROLE_ID
Update all permissions for a specific role.
Example:
curl -X PUT http://127.0.0.1:8888/permissions/roles/test_role \
-H 'Accept: application/json' \
-H 'opscenter-session: 12345ABC' \
-d '{"Test_Cluster": {"View Cluster": true}}'No output.
POST /permissions/roles/ROLE_ID
Create permissions for a specific role.
Example:
curl -X POST http://127.0.0.1:8888/permissions/roles/test_role \
-H 'opscenter-session: 12345ABC' \
-H 'Accept: application/json' \
-d '{"Test_Cluster": {"View Cluster": true}}'No output.
DELETE /permissions/roles/ROLE_ID
Delete all permissions for a specific role.
Example:
curl -X DELETE http://127.0.0.1:8888/permissions/roles/test_role \
-H 'opscenter-session: 12345ABC'No output.
GET /users
Get the list of all users.
Example:
In addition to the roles property, the role property will be present in the response if the given user has 0 or 1 roles for backwards compatibility.
The role property will be removed in future versions of OpsCenter.
curl http://127.0.0.1:8888/users \
-H 'opscenter-session: 12345ABC'Output:
[
{
"roles": ["power_user"],
"username": "testuser"
}
]GET /users/USERNAME
Gets the role of a user.
Returns username/role.
Example:
curl http://127.0.0.1:8888/users/testuser \
-H 'opscenter-session: 12345ABC'Output:
{"username": "testuser", "role": "power_user", "roles": ["power_user"]}POST /users/USERNAME
Creates a new user and accepts a JSON map with a password and role.
Example:
curl -X POST http://127.0.0.1:8888/users/testuser \
-H 'opscenter-session: 12345ABC' \
-H 'Accept: application/json' \
-d '{"password": "test", "role": "test_role"}'No output.
PUT /users/USERNAME
Updates an existing user, accepts a JSON map with a password, a role, or both.
Users can update their own password and they must supply the additional "old_password" parameter that must match their current password. Users can update their own role only if they are an admin user.
Example:
curl -X PUT http://127.0.0.1:8888/users/testuser \
-H 'opscenter-session: 12345ABC' \
-H 'Accept: application/json' \
-d '{"password": "test", "old_password": "changeme" }'curl -X PUT http://127.0.0.1:8888/users/otheruser \
-H 'opscenter-session: 12345ABC' \
-H 'Accept: application/json' \
-d '{"password": "test", "role": "test_role"}'No output.
DELETE /users/USERNAME
Deletes an existing user.
Example:
curl -X DELETE http://127.0.0.1:8888/users/testuser \
-H 'opscenter-session: 12345ABC'No output.
