Cisco ISE: REST API with Python - Get Internal Users

I am currently building python scripts to automate Cisco ISE configuration.

Going through ISE documentation, I am exploring some errors in the python examples which won't work for ISE 2.3. I will be posting the corrections while I am exploring them. 

The first one was in "get-all-internal-users.py" example. 

ISE 2.3 doesn't support TLS 1.0 by default. Instead it supports TLS 1.2. 

The default script:

#!/usr/bin/env python

###########################################################################

#                                                                         #

# This script demonstrates how to use the ISE ERS internal users          #

# API  by executing a Python script.                                      #

#                                                                         #

# SECURITY WARNING - DO NOT USE THIS SCRIPT IN PRODUCTION!                #

# The script allows connections to SSL sites without trusting             #

# the server certificates.                                                #

# For production, it is required to add certificate check.                #

#                                                                         #

# Usage: get-all-internal-users.py    #

###########################################################################

import http.client

import base64

import ssl

import sys

# host and authentication credentials

host = sys.argv[1] # "10.20.30.40"

user = sys.argv[2] # "ersad"

password = sys.argv[3] # "Password1"

conn = http.client.HTTPSConnection("{}:9060".format(host), context=ssl.SSLContext(ssl.PROTOCOL_TLSv1))

creds = str.encode(':'.join((user, password)))

encodedAuth = bytes.decode(base64.b64encode(creds))

.........

This won't work due to SSL version mismatch

The correct version is:

###########################################################################

#                                                                         #

# This script demonstrates how to use the ISE ERS internal users          #

# API  by executing a Python script.                                      #

#                                                                         #

# SECURITY WARNING - DO NOT USE THIS SCRIPT IN PRODUCTION!                #

# The script allows connections to SSL sites without trusting             #

# the server certificates.                                                #

# For production, it is required to add certificate check.                #

#                                                                         #

# Usage: get-all-internal-users.py    #

#                                                                         #

# The script should be modified to use SSL TLS v1.2 instead of TLS v1.0   #

# This is required for ISE 2.3                                            #

###########################################################################

import http.client

import base64

import ssl

import sys

# host and authentication credentials

host = sys.argv[1] # "10.20.30.40"

user = sys.argv[2] # "ersad"

password = sys.argv[3] # "Password1"

conn = http.client.HTTPSConnection("{}:9060".format(host), context=ssl.SSLContext(ssl.PROTOCOL_TLSv1_2))

creds = str.encode(':'.join((user, password)))

encodedAuth = bytes.decode(base64.b64encode(creds))

.......

Have you tried to use PyCrypto in Python 3.x?

I had a requirement to use PyCrypto and was running Python 3.6.2. In summary it won't work. If you want to continue with Python 3.6.2, you need to use PyCryptodome.

Otherwise, downgrade to Python 3.5.2 with the follow requirements:

1. Before installation of pycrypto (pip install pycrypto) make sure that you install Microsoft Visual C++ Build Tools (2015)

2. After installation of pycrypto Navigate to Python installation folder (in my case its C:\Program Files (x86)\Python35-32\)

3. Find and edit the script C:\Program Files (x86)\Python35-32\Lib\site-packages\Crypto\Random\OSRNG\nt.py

4. Replace the line (import winrandom) with (from . import winrandom)

Python Script to Read XML Files

Typical use of this when you have M2M interaction and you receive data in XML format where the receiver should react accordingly.

Here is a sample XML file:
************************

Python Code
************************

def get_client_settings (element):
 
    # This function gets client details from XML file
 
    ip_attrib = element.get('ip')
    username_attrib = element.get('username')
    password_attrib = element.get('password')
    email_attrib = element.get ('mail')
         
    for alert in element.findall('alert'):
        if alert.get('type').lower() == 'memory':
            mem_alert = float(alert.get('limit').replace('%',''))
        if alert.get('type').lower() == 'cpu':
            cpu_alert = float(alert.get('limit').replace('%',''))
           
    return (ip_attrib, username_attrib, password_attrib, email_attrib, mem_alert, cpu_alert)

for element in root_element.findall('client'):

    print ('\nGetting user details')
    ip, username, password, email, mem_limit, cpu_limit = get_client_settings (element)