Disabling basic and cookie-based authentication via API in NSX

Products

• VMware NSX

Issue/Introduction

This article provides the steps to disable legacy or less secure authentication methods (Basic and Cookie-based) in NSX Manager as part of security hardening or audit requirements.

Disabling legacy or less secure authentication methods (Basic and Cookie-based) in NSX Manager satisfies security hardening and audit requirements. Default configurations allow these methods for administrative and API access to ensure compatibility with various clients and integrations.

Symptoms

• Security audits require disabling HTTP Basic Authentication and Cookie-based Authentication.
• Management Plane API authentication methods must be restricted

Environment

VMware NSX 4.x

Cause

Default NSX configurations allow both Basic and Cookie-based authentication for administrative and API access to ensure compatibility with various clients and integrations.

Resolution

The authentication policy for the NSX API service is managed via the ApiServiceConfig API. Disabling these methods will affect all clients, including the NSX Manager UI, which relies on cookie-based sessions.

1. Retrieve current configuration: Perform a GET request to obtain the current settings and the mandatory _revision field. GET https://<NSX-Manager-IP>/api/v1/cluster/api-service

2. Update the authentication policy: Perform a PUT request to disable the desired methods. Use the _revision number from Step 1. PUT https://<NSX-Manager-IP>/api/v1/cluster/api-service

    

    JSON Body:
   json

    

   {  "_revision": ####,  "basic_authentication_enabled": false,  "cookie_based_authentication_enabled": false}

   
   Note: Ensure all other required fields from the GET response are included in the PUT body.

3. Verify changes: Attempt an API call using Basic Authentication; the manager should return a 401 Unauthorized error.

Impact on AD/LDAP Users: 

Disabling basic authentication prevents users from using the Authorization: Basic header. If using AD over LDAP, users must transition to using the Session API (/api/session/create) to obtain a temporary token for subsequent calls.

Impact on VCF Usage Meter:

Basic Authentication is a requirement for VCF Usage Meter integration. Core VCF components (SDDC Manager) rely on these credentials for password rotation and lifecycle management. Disabling these methods will break Usage Meter registration and metering.

Additional Information

HTTP Authentication using APIs on NSX.

NSX-T API Usage

Disable/Enable VMware NSX Manager/Global manager Ciphers or TLS Settings