Authentication Methods

SonicOS API supports four authentication mechanisms that share the same endpoint for client login and logout.

Endpoint	HTTP Method & Body
	GET	POST	PUT	DELETE
URI: /api/sonicos/auth	Empty	Empty	—	Empty

1. Navigate to DEVICE | Settings > Administration | SonicOS API.

   

2. In this page perform the following:

   • Enable/Disable SonicOS API button.

   • Enable/Disable RFC-7616 HTTP Digest Access authentication.

   • Select the Digest algorithms: SHA256 or MD5.
   • Select the Integrity protection: Disabled, Allowed, or Enforced.
   • Use session variant (password hashes in place of passwords): Disabled, Allowed, or Enforced.
   • Enable/Disable CHAP authentication.
   • Enable/Disable RFC-2617 HTTP Basic Access authentication

   • Enable/Disable Public Key Authentication.

   • Specify the RSA modulus (key/cipher size in bits): 2014 is the default.

   • Select the RSA padding type: PKCS#1 v1.5 or PKCS#1 v2.0 OAEP

   • Select the OAEP hash method: SHA-1, SHA-256, or Other
   • Select the OAEP mask (MGF1) method: SHA1, SHA-256, or Other
   • Enable/Disable Session security using RFC-7616 Digest authentication.
   • Specify the Maximum nonce use: 10 by default
   • Enable/Disable Two-Factor Bearer Token Authentication.

It is highly recommended to call delete api/sonicos/auth to log out of the API session, with bearer token or user name/password(optional by configuration). Otherwise, the session is closed after a time of inactivity.

The settings for RFC-7616 Digest Authentication also apply to session security. If the settings are disabled for RFC-7616, they are enabled for session security.