How-To: Authenticate requests to the Contrail Python API library

By p.k posted 01-08-2016 09:40


Examples provided in Contrail Configuration API server documentation at:


Assume no authentication of the incoming API connection. However recent versions of Contrail (such as 2.21) require authentication of API requests by default.


Although one solution is to disable authentication, as described in
it is possible to just authenticate the requests as presented in example script below.

The tricky part is that both api_server_host and auth_host parameters must be provided, even if their IP addresses are the same. The tenant_name parameter is required as well, together with username and password.



root@openstack:~/scripts# cat
#! /usr/bin/python

from vnc_api import vnc_api
from pprint import pprint

vnc_lib = vnc_api.VncApi(api_server_host = '', 
        auth_host = '',
        username = 'admin', password = 'contrail', tenant_name = 'admin')

net_list = vnc_lib.virtual_networks_list()

for vn in net_list['virtual-networks']:
    pprint( vn['fq_name'] ) 

root@openstack:~/scripts# python 
[u'default-domain', u'default-project', u'__link_local__']
[u'default-domain', u'demo', u'VN-A']
[u'default-domain', u'default-project', u'ip-fabric']
[u'default-domain', u'default-project', u'default-virtual-network']