Single API call with authentication in Python

Question

I've written a small script for Zabbix to check the status of our ESXi Hosts. The request needs to be authenticated, so I went for this process:

1. Read auth token from file
   1. If file does not exist, authenticate and store token into file
2. Run request to get the information
   1. If I get permission denied, authenticate, store the token into file and try again

Is there a better way to handle this? It bothers me a little to have the get_host_state() call twice, but placing the handling of the permission error into the function would make it recursive, which would then need additional parameters to prevent an endless loop and which would make it more complex.

Could the functions themselves be improved?

Notes:

• I'm aware that there are existing python modules to access the API, but I want to avoid the hassle and overhead of setting up a virtualenv and installing countless python modules on the Zabbix server for a simple check
• I disabled the traceback on purpose because I get the first line of the output of the script directly in Zabbix when an error occurs and this way I see directly the error instead of the pretty useless first line of the stacktrace.

The response from the API is json, which is then parsed and handled in Zabbix.

full script:

import requests
import sys

vc_url = "vcenter.example.com"
vc_user = "[email protected]"
vc_password = "aHR0cDovL2JpdC5seS8xVHFjd243Cg=="
auth_store = "/tmp/zbx_esxi_connstate_auth"

esx_name = sys.argv[1]

session_id = ''
sys.tracebacklimit = 0

def vc_auth():
  response = requests.post(f"https://{vc_url}/api/session", auth=(vc_user, vc_password))
  if response.ok:
    session_id = response.json()
    with open(auth_store, "w") as file:
      file.write(session_id)
    return session_id
  else:
    raise PermissionError("Unable to retrieve a session ID.")

def read_auth():
  try:
    with open(auth_store, "r") as file:
      session_id = file.read()
      return session_id
  except FileNotFoundError:
    vc_auth()

def get_host_state():
  response = requests.get(f"https://{vc_url}/api/vcenter/host?names={esx_name}", headers={"vmware-api-session-id": session_id})
  if response.status_code == 401:
    raise PermissionError("Authentication required.")
  if response.ok:
    print(f"{response.text}")
  else:
    raise ValueError(response.text)

session_id = read_auth()
try:
  get_host_state()
except PermissionError:
  session_id = vc_auth()
  get_host_state()

Here is the response from the API for the authentication request:

HTTP/2 201
date: Thu, 15 Sep 2022 13:28:26 GMT
vmware-api-session-id: 39efaf9c1c0ababc005ce63795b773bc
content-type: application/json
x-envoy-upstream-service-time: 169
server: envoy

"39efaf9c1c0ababc005ce63795b773bc"

Answer 1

Instead of using:

esx_name = sys.argv[1]

prefer the argparse library which is more flexible and allows for variable argument positioning.

In read_auth you have: except FileNotFoundError but this is an exception that is preventable so it would be easier to just check that the file does exist eg:

from os.path import exists
if not exists(auth_store)...

or better yet:

from pathlib import Path
if not Path(auth_store).is_file()

Instead of doing plain plain requests.get or requests.post prefer requests.Session(). One benefit is that the session instance can contain predefined headers including the auth token, so there is no need to repeat those headers in every subsequent request. Just do session.post() etc, and you can still provide additional headers on a per request basis if needed. This will come in handy when and if you add more methods.

Have you considered writing a small class to wrap this all up? The session ID could be made a class property with an initial value of None.

There is one challenge in your program, it is that the token may expire after some time but you don't know when. Since the requests library has callbacks (called event hooks), it could be interesting to use the functionality to handle automatic and transparent re-authentication whenever needed. This could easily turn into another bigger challenge but that's an idea though.

Have a look here for a possible solution: Python Requests - retry request after re-authentication. Another option is to use the retry on failure capabilities of the requests lib. This is more advanced stuff and it requires you to tinker with HTTPAdapter but it's worth it for bigger projects surely.

Let's note that response.ok actually does not match a HTTP/200 (OK) response:

Returns True if status_code is less than 400, False if not.

This attribute checks if the status code of the response is between 400 and 600 to see if there was a client error or a server error. If the status code is between 200 and 400, this will return True. This is not a check to see if the response code is 200 OK.

Source: Developer Interface

It may be a convenient shorthand to handle both 200 and 201 though, as long as you are aware of how it works.

You can also use predefined codes for HTTP errors, for example for 401: requests.codes.unauthorized and 201: requests.codes.created. Use response.status_code to get the actual HTTP response code. And you can indeed use requests.codes.ok if you really want to check for HTTP/200.

Instead of using PermissionError it would make more sense to use the set of native requests exceptions. Or just use raise_for_status().