Get-FGTSystemAdmin doesn't work when VDOMs are enabled

[bscheewe]

Wow what a great tool! Thank you!

System admins are stored in the Global level when VDOMs are enabled and not in a VDOM. How can global be checked? I tried "-vdom global" but that didn't work.

[bscheewe]

I also tried this and no results returned.

(Invoke-FGTRestMethod -method "get" -uri "api/v2/cmdb/system/admin/").results

[alagoutte]

Hi,

what fortiOS release ? Do use the admin account or limited account ? With what right ?

[bscheewe]

If I Invoke-FGTRestMethod without the .results, here is what I see. However targeting accprofile does return results.

PS C:\temp> Invoke-FGTRestMethod api/v2/cmdb/system/admin/
http_method   : GET
size          : 19
matched_count : 0
next_idx      : 18
revision      : a60866ff72deb9d030baa27e39b2f3da
results       : {}
vdom          : root
path          : system
name          : admin
status        : success
http_status   : 200
serial        : FG5H0E5819900050
version       : v7.0.12
build         : 523



PS C:\temp> Invoke-FGTRestMethod api/v2/cmdb/system/accprofile
http_method   : GET
size          : 7
matched_count : 7
next_idx      : 6
revision      : f7d4ac47884dbfd1d17d829ddfbaee07
results       : {USER GROUPS SHOW UP HERE - REMOVED}
vdom          : root
path          : system
name          : accprofile
status        : success
http_status   : 200
serial        : FG5H0E5819900050
version       : v7.0.12
build         : 523

Here are details about the Fortigate and the account.

config system accprofile
    edit "API-User"
        set scope global
        set secfabgrp read
        set ftviewgrp read
        set authgrp read
        set sysgrp read
        set netgrp read
        set loggrp read
        set fwgrp read
        set vpngrp read
        set utmgrp read
        set wifi read
    next
end

config system api-user
    edit "API-User"
        set api-key ENC XXXXXXXXXXXXXXXXXXXX
        set accprofile "API-User"
        set vdom "root"
        config trusthost
            edit 1
                set ipv4-trusthost 10.0.0.0 255.0.0.0
            next
        end
    next
end

Primary (global) # get sys status 
Version: FortiGate-500E v7.0.12,build0523,230606 (GA.M)

I can't remove set vdom "root" because the VDOM assignment is required, and there's no global option.

[alagoutte]

if you create a real user, can you display the list of user ?

can you try to add ?scope=global (or vdom, both) to the URI ?

you can configure also the "vdom" using Set-FGTConnection -vdom XXX (may be try to use global)

[bscheewe]

Ah! If I use a normal user account I can get the admin accounts. I was using a user that has super_admin rights. I ended up editing the accprofile to this and it works now.

    edit "ScriptRunner"
        set scope global
        set secfabgrp read
        set ftviewgrp read
        set authgrp read
        set sysgrp custom
        set netgrp read
        set loggrp read
        set fwgrp read
        set vpngrp read
        set utmgrp read
        set wifi read
        config sysgrp-permission
            set admin read
            set upd read
            set cfg read
            set mnt read
        end
    next
end

This doesn't make sense, since this is the same as setting set sysgrp read but it's working, so I'll leave it! Thanks for your help, and thanks for making this great tool!