No API access through User Manager authentication

RouterOS The User Manager
1

Hello,

We are using the User- Manager for management authentication on a range of routers.

We would like to retrieve information from the routers through the rest-api.
When I do a api request I get an error message not authorized and in the router Log there is a authentication failure via rest-api.

When using the same api request with an user that is locally defined, it works!

The credentials are correct and the correct user group is applied.
I’m able to login through Winbox without a problem.

Is this a configuration error of maybe a build-in restriction or a bug?

We don’t want to add local users in over 40 routers, that’s why we use the User-Manager.

Any help is appreciated.

Regards,
Edwin

2

You need to configure local user authentication via RADIUS.

(AAA under System→Users, possibly RADIUS settings as well)

3

@pe1chl is right.

You do need enable AAA in /user and enable RADIUS locally to user-manager:

/user aaa set default-group=read use-radius=yes
/radius add address=127.0.0.1 service=login
/radius incoming set accept=yes

And firewall may need to allow localhost on chain=input.

You can control the group assigned in user manager via MikroTik-Group attribute:

/user-manager user set [find name="umadmin"] attributes=Mikrotik-Group:full
4

This is set and the Radius authorization works!

Winbox and Web login also works fine!
It’s just de API that giving a login error.

5

Do you mean the native API, or the REST API?

I tested REST API using 7.21rc3 with a UM user and it works.

6

I updated to 7.21rc4, but no change.
I just give a simple request: http://192.168.88.1/rest/system/clock

I’ll have a look next week again.

7

Odd problem.

I'd check the firewall to make sure it allows localhost (for RADIUS access from router processes). Perhaps winbox auth acts different, IDK.

Can also add debug log topic while testing to see what's actually happening.

8

Hello,

Happy new year!

Just want to let you know, I found the problem.

In the log I found an error, saying maximum sessions reached.
The user limit was set to 1. I don’t know why, but it seems this needs to be set to at least 2 sessions.

After this, the authentication works.

Thanks for the help!