Troubleshooting API Credentials (Zscaler)

jzrts · October 17, 2023, 4:28pm

Hi,

We’re unable to connect n8n to our Zscaler ZIA API due to a 403 error so I wanted to ask if anyone has experience with this or ideas how to troubleshoot.

So far we have:

Obtained admin credentials and the API key for Zscaler
Successfully used those credentials in the Postman API SDK published by Zscaler to authenticate and read data from the API
Put the same credentials into n8n, and got a 403 error when testing the connection

Do you have any suggestions what we should check/change or how to make it work?

Thanks!

jzrts · October 17, 2023, 5:34pm

Quick update on this: even though the test credential function fails with a 403 error, the credential is useable in flows and does work for API access. So maybe it’s just a minor issue with the test capability. But the important functionality still works.

RCS · October 17, 2023, 10:04pm

May be a stupid question. What are you using n8n with Zscaler for?

We are just doing a Zscaler spin up at work so you have me interested.

MutedJam · October 18, 2023, 9:19am

Thanks so much for confirming this is working in general @jzrts and sorry for the trouble with the credentials test.

I suspect what’s happening here is that your user account might not have permissions for the request used to test the credentials:

github.com

n8n-io/n8n/blob/d8531a53b9a256095157129b64adde7749aa84c9/packages/nodes-base/credentials/ZscalerZiaApi.credentials.ts#L134


      
          		type: 'generic',
          		properties: {
          			headers: {
          				Cookie: '={{$credentials.cookie}}',
          			},
          		},
          	};
          
          
	test: ICredentialTestRequest = {
          		request: {
          			url: '=https://{{$credentials.baseUrl}}/api/v1/authSettings/exemptedUrls',
          		},
          	};
          }

Perhaps you can send a request to https://{{$credentials.baseUrl}}/api/v1/authSettings/exemptedUrls using the HTTP Request node and check the full response you’re getting? With a bit of luck Zscaler sends a comprehensive response explaining what’s missing

jzrts · October 18, 2023, 4:01pm

That was the problem. We only granted our API key permission to read Zscaler location configuration, not anything else. So the built-in test was denied, but still it could satisfy our use case to check the location configuration. Thanks for your help!

system · January 16, 2024, 4:01pm

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.