Veeam EM REST - session authenticated, on next GET call session is invalid

[kosov.janko]

Dear Veeam team,

we're observing strange behaviour with Veeam EM REST API endpoint.

Veeam is version 9.5.4.2753

First the user is authenticated:

Code: Select all

[14.10.2019 19:02:02] <12> Info     User [DOMAIN\USER] was successfully logged on.

On next GET call the session is invalid:

Code: Select all

[14.10.2019 19:02:03] <12> Info     [GET] request to [https://vem-server:9398/api/hierarchyRoots?format=Entity] deserialized. Message: []; Parameters: [].
[14.10.2019 19:02:03] <12> Error    Failed to retrieve root hosts. RequestUri: [https://vem-server:9398/api/hierarchyRoots?format=Entity].
[14.10.2019 19:02:03] <12> Error    Identity was not authenticated. (Veeam.Backup.Interaction.RestAPI.CRestAPICommunicationException)

Is there a TRACE, DEBUG that I can enabled on REST API endpoint to see the reason why this is happening?

[veremin]

Can you post your code here? I'm interested mostly in authentication part. Thanks!

[kosov.janko]

See below...

[kosov.janko]

Dear veremin,

better I'll provide you with the TRACE logs...

Could not paste directly here hence - https://pastebin.com/3Tcf3PRU

[chris.arceneaux]

I don't see problems with your API call. The Authorization header is only necessary when logging in but, even then, that should not give you the problem you are seeing. Here is the Veeam documentation for the API call.

Make sure the X-RestSvcSessionId is being properly added to your API call as that's most likely what's causing the problem you're seeing. If you paste the corresponding snippets of your code here I can give it a lookover.

You can paste code directly to this forum using the example here or you can continue to use pastebin.

[ssimakov]

The problem is that both Authorization and X-RestSvcSessionId headers are present, the server does not like it. That's pretty much a bug but in any case it should be working fine if you modify your code to include X-RestSvcSessionId only.

Edit after some testing: what version are you running it against? I see mixed results with different servers so could be version/environment specific. Also just to double check: are you positive you don't get characters added/removed when constructing the headers?

[ssimakov]

And then I found out the reason of inconsistencies in my tests - the server with which I managed to reproduce this behavior is accessible via a middleware that strips X-* headers. So in my case it was not headers related but environmental, apologies for confusion.