Fabric authenticate (/fabric/authenticate)
URL: https://[server_name]/api/fabric/authenticate
This endpoint is used to deliver an access_token to FortiOS to integrate the FortiAuthenticator as a Fortinet Security Fabric device. Currently, these tokens do not expire, as long as the access token expiry of the default FortiOS fabric application remains at zero.
Supported fields
| Field | Display name | Type | Required | Other restrictions |
|---|---|---|---|---|
| username | Administrator password | string | Yes, unless refreshing token |
User should not require multi-factor authentication, and must have Widget read/write permissions or full permissions. |
| password | Administrator password | string | Yes, unless refreshing token | |
| grant_type | OAuth grant type | string | If refreshing token | |
| refresh_token | OAuth refresh token | string | If refreshing token |
Note: Currently, FortiOS is not configured to refresh the token, so the token does not expire. Therefore, the refresh tokens that result from the application are set to zero.
Allowed methods
| HTTP method | Resource URI | Action |
|---|---|---|
| POST | /api/fabric/authenticate | Get token, or refresh token |
Note:
- If the user requires multi-factor authentication, this is bypassed when issuing an OAuth token. FortiOS does not yet prompt for additional challenges after the username and password.
- If your username is in email address format, and your Username/Realm format under Authentication > Self-Service Portal > Access Control uses the '@' symbol, ensure that you specify the realm. E.g. user@name.com@realm
- If authenticating multiple FortiOS devices with the Security Fabric endpoint, copy and paste the token from the first authentication onto subsequent devices. Authenticating will generate a new token.
Response codes
In addition to the general codes defined in General API response codes, a POST request to this resource can also result in the following return codes:
| Code | Response content | Description |
|---|---|---|
| 200 OK | Valid credentials | |
| 401 Unauthorized | Invalid credentials, or user improperly configured. |
Example
Get token:
curl -k -v -X POST \
https://[FortiAuthenticator_IP]/api/fabric/authenticate \
-H 'Content-Type: application/json' \
-d '{
"username": "tfadmin",
"password": "12345678"
}'
Response:
{
"access_token": "shrWNdu1xJRUgpcUi2bhYRX1Sl8pXe",
"expires_in": 0,
"message": "successfully authenticated",
"refresh_token": "tU85BMdOoV3pktSSiLaABJN7ySiADZ",
"scope": "read",
"success": "true",
"token_type": "Bearer"
}
Refresh a token (for future reference):
curl -k -v -X POST \
https://[FortiAuthenticator_IP]/api/fabric/authenticate \
-H 'Content-Type: application/json' \
-d '{
"grant_type": "refresh_token",
"refresh_token": "Y53b5XCLUdjkHVH49ZSheYQjafn6EV"
}'
Response:
{
"access_token": "fzMK69MdyA0vRJXh2CWnuHRcpuQrpL",
"expires_in": 0,
"message": "Token has been refreshed successfully",
"refresh_token": "UqCV1xEPSoq4vSLE0YgXAkF2zzMGO5",
"scope": "read",
"success": "true",
"token_type": "Bearer"
}