使用Python和REST API管理安全訪問目標清單

簡介

本文檔介紹如何使用Python和REST API對目標清單執行所有可能的操作。

必要條件

思科建議您瞭解以下主題：

1. Python
2. REST API
3. Cisco Secure Access

需求

在繼續操作之前，必須滿足以下要求：

• 具有Full Adminuser角色的Cisco Secure Access用戶帳戶。
• 思科安全雲單一登入(SCSO)帳戶登入以安全訪問。
• 建立您的安全訪問API金鑰

採用元件

本文中的資訊係根據以下軟體和硬體版本：

• 安全訪問控制面板
• Python 3.x

本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路運作中，請確保您瞭解任何指令可能造成的影響。

設定

編寫此代碼的方法有多種，考慮多個方面，如錯誤處理、令牌有效性（3600秒）等。

請確保在運行指令碼之前安裝這些Python庫：

pip install requests
pip install oauthlib
pip install requests_oauthlib

指令碼

請確保分別用您的client_id和client_secret替換本腳本API KeyKey Secret中的和。

from oauthlib.oauth2 import BackendApplicationClient
from oauthlib.oauth2 import TokenExpiredError
from requests_oauthlib import OAuth2Session
from requests.auth import HTTPBasicAuth
import time
import requests
import pprint
import json


def fetch_headers(BToken):
	BT = f"Bearer {BToken}"
	headers = { 'Authorization':BT,
			"Content-Type": "application/json",
			"Accept": "application/json" 
			}
	return headers

# GET OAUTH 2.0 TOKEN
def getToken():
	token_url = 'https://api.sse.cisco.com/auth/v2/token'
	try:
		#ASSIGN your API Key to the variable client_id and Secret Key to the variable client_secret
		client_id = "XXXXXXXXXXXXXXXXXXXXXXXXXXXX"
		client_secret = "XXXXXXXXXXXXXXXXXXXXXXXXXXXX"

		auth = HTTPBasicAuth(client_id, client_secret)
		client = BackendApplicationClient(client_id=client_id)
		oauth = OAuth2Session(client=client)
		token = oauth.fetch_token(token_url=token_url, auth=auth)
        print("\n######Token Generated Successfully######\n")
		return token
	except e as Exception:
		print(f"Encountered an error while Fetching the TOKEN :: {e}")


# 1 - GET DESTINATION LISTS
def fetch_destinationlists(h):
	url = "https://api.sse.cisco.com/policies/v2/destinationlists"
	try:
		response = requests.request('GET', url, headers=h)
		json_object = json.loads(response.content)

		#pprint.pprint(json_object)
		x=1
		for item in json_object["data"]:
			print(f"Destination List : {x}")
			pprint.pprint(f"Name : {item['name']}")
			pprint.pprint(f"ID : {item['id']}")
			#pprint.pprint(f"Destination Count : {item['meta']['destinationCount']}")
			print("\n")
			x+=1
	except e as Exception:
		print(f"Encountered an Error while Fetching the Destination Lists :: {e}")


# 2 - GET DESTINATION LIST
def get_destinationlist(h):
	try:
		choice = input("Enter the ID of the DestinationList:: ")
		url = "https://api.sse.cisco.com/policies/v2/destinationlists/" + choice
		response = requests.request('GET', url, headers=h)
		json_object = json.loads(response.content)
		print("\n\n")
		pprint.pprint(json_object)
		print("\n\n")
	except e as Exception:
		print(f"Encountered an Error while Fetching the Destination List Details :: {e}")


# 3 - CREATE DESTINATION LIST
def create_destinationlist(h):
	url = "https://api.sse.cisco.com/policies/v2/destinationlists"
	try:
		naav = input("Name of the DestinationList :: ")
		payload = {
		    "access": "none",
		    "isGlobal": False,
		    "name": naav,	
		    }
		response = requests.request('POST', url, headers=h, data = json.dumps(payload))
		json_object = json.loads(response.content)
		print("\n\n")
		pprint.pprint(json_object)
		print("\n\n")
	except e as Exception:
		print(f"Encountered an Error while Creating the Destination List :: {e}")


# 4 - UPDATE DESTINATION LIST NAME
def patch_destinationlist(h):
	try:
		choice = input("Enter the ID of the DestinationList for changing it's name :: ")
		url = "https://api.sse.cisco.com/policies/v2/destinationlists/" + choice
		naav = input("Enter New Name :: ")
		payload = {"name": naav}

		response = requests.request('PATCH', url, headers=h, data = json.dumps(payload))
		json_object = json.loads(response.content)
		print("\n\n")
		pprint.pprint(json_object)
		print("\n\n")
	except e as Exception:
		print(f"Encountered an Error while Updating the Destination List :: {e}")


# 5 - DELETE DESTINATION LIST
def delete_destinationlist(h):
	try:
		choice = input("Enter the ID of the DestinationList for DELETION :: ")
		url = "https://api.sse.cisco.com/policies/v2/destinationlists/" + choice

		response = requests.request('DELETE', url, headers=h)
		json_object = json.loads(response.content)
		print("\n\n")
		pprint.pprint(json_object)
		print("\n\n")
	except Exception as e:
		print(f"Encountered an Error while Deleting the Destination List :: {e}")


# 6 - GET DESTINATIONS FROM A DESTINATION LIST
def fetch_detail(h):
	try:
		choice = input("DestinationList ID: ")

		url2 = "https://api.sse.cisco.com/policies/v2/destinationlists/" + choice + "/destinations"

		response = requests.request('GET', url2, headers=h)
		print("\n")
		json_dest = json.loads(response.content)
		pprint.pprint(json_dest)
		print("\n\n")
	except e as Exception:
		print(f"Encountered an Error while Fetching the Destinations from the Destination List :: {e}")


# 7 - ADD DESTINATIONS TO A DESTINATION LIST
def add_destinations(h):
	try:
		choice = input("Enter the ID of the DestinationList :: ")
		url = "https://api.sse.cisco.com/policies/v2/destinationlists/" + choice + "/destinations"
		destination_to_add = input("\nEnter the destination that you want to add :: ")
		payload = [{"destination": destination_to_add}]
		
		response = requests.request('POST', url, headers=h, data = json.dumps(payload))
		print("\n")
		json_dest = json.loads(response.content)
		pprint.pprint(json_dest)
		print("\n\n")
	except e as Exception:
		print(f"Encountered an Error while Adding the Destination to the Destination List :: {e}")


# 8 - DELETE DESTINATIONS FROM DESTINATION LIST
def delete_entry(h):
	try:
		choice_del = input("\nCONFIRM DestinationList ID from which you want to delete the Destination :: ")
		url3 = "https://api.sse.cisco.com/policies/v2/destinationlists/" + choice_del + "/destinations/remove"
		dest = int(input("ID of the Destination that you want to remove: "))

		payload = f"[{dest}]"
		response = requests.request('DELETE', url3, headers=h, data=payload)
		json_del = json.loads(response.content)
		print("\n\n")
		pprint.pprint(json_del)
		print("\n\n")
	except e as Exception:
		print(f"Encountered an Error while Deleting a Destination from the Destination List :: {e}")



#FETCH COOKIE
possess_cookie = " "
while possess_cookie not in ["Y","y","N","n"]:
    possess_cookie = input("Token Already Generated? (Y/N) :: ")
    if possess_cookie.upper() =="N":
    	cook = getToken()
    	with open("cookie.txt","w") as wr:
    		wr.writelines(cook["access_token"])
#    	print(f"Access Token = {cook["access_token"]}")


#FETCH HEADERS
with open("cookie.txt","r") as ree:
	h = fetch_headers(ree.readline())


print("\n")
while True:
	action = input("""Available operations:
1. Get Destination Lists
2. Get Destination List
3. Create Destination List
4. Update Destination List Name
5. Delete Destination List
6. Get Destinations from Destination List
7. Add Destinations to a Destination List
8. Delete Destinations from Destination List
9. Exit

Enter Your Choice :: """)

	print("\n")
	operation = action.replace(" ","")
	if operation == "1":
		fetch_destinationlists(h)

	elif operation == "2":
		fetch_destinationlists(h)
		get_destinationlist(h)

	elif operation == "3":
		create_destinationlist(h)

	elif operation == "4":
		fetch_destinationlists(h)
		patch_destinationlist(h)

	elif operation == "5":
		fetch_destinationlists(h)
		delete_destinationlist(h)

	elif operation == "6":
		fetch_destinationlists(h)
		fetch_detail(h)

	elif operation == "7":
		fetch_destinationlists(h)
		add_destinations(h)
	
	elif operation == "8":
		fetch_destinationlists(h)
		fetch_detail(h)
		delete_entry(h)

	elif operation == "9":
		break
	
	else:
		print("\n")
		print("==========INCORRECT INPUT==========")
		print("\n")

print("Thank You!!! Good Bye!!!")
time.sleep(5)

輸出：

此指令碼的輸出必須如下所示：

Cookie Already Generated? (Y/N) :: y


Available operations:
1. Get Destination Lists
2. Get Destination List
3. Create Destination List
4. Update Destination List Name
5. Delete Destination List
6. Get Destinations from Destination List
7. Add Destinations to a Destination List
8. Delete Destinations from Destination List
9. Exit

Enter Your Choice :: 

Token Already Generated? (Y/N) :: y

Available operations:
1. Get Destination Lists
2. Get Destination List
3. Create Destination List
4. Update Destination List Name
5. Delete Destination List
6. Get Destinations from Destination List
7. Add Destinations to a Destination List
8. Delete Destinations from Destination List
9. Exit

Enter Your Choice :: 1​

成功執行此程式後，開始會詢問有關Cookie的問題Cookie Already Generated? (Y/N)。提出此問題的原因是為了確保不會多次生成cookie，因為cookie一旦生成，其有效期為3600秒（1小時）。 如果輸入yY，則不會生成新的cookie。但是，如果您輸入n或N，則會生成一個新的cookie，並將其儲存到同一目錄/資料夾中的本地文本檔案中。此檔案中的cookie將用於後續請求。 

錯誤

如果為任何要求您提及DestinationList ID的操作輸入的ID不正確，可能會遇到此錯誤：

{'message': 'no Route matched with those values'}

建立DestinationList時，如果您提到超過255個字元的DestinationList的名稱，則會看到以下錯誤：

{'code': 400,
'code_text': 'Bad Request',
'error': 'invalid_request',
'message': {'name': {'code': 'string_invalid',
'code_text': 'must be fewer than 255 characters long'}},
'statusCode': 400,
'txId': 'l23f0cjk62fe'}

您也可以使用Secure Access Developers User Guide獲取有關策略、漫遊電腦、報告等的資訊。

疑難排解

安全訪問API端點使用HTTP響應代碼來指示API請求的成敗。通常，2xx範圍內的代碼指示成功，4xx範圍內的代碼指示由所提供的資訊導致的錯誤，而5xx範圍內的代碼指示伺服器錯誤。解決該問題的方法取決於收到的響應代碼：

REST API — 響應代碼1

REST API — 響應代碼2

相關資訊

• 思科安全訪問使用手冊
• 思科技術支援和下載
• 新增安全訪問API金鑰
• 開發人員使用手冊
• 配置安全訪問，以便使用REST API和Python
• 通過cURL管理目標清單