[O11y][CItrix ADC] Support NITRO SESSION Authentication mechanism for interface, lbvserver, vpn, system and server data streams

[harnish-elastic]

Issue and analysis

Currently, the Citrix ADC supports Basic Auth mechanism to authenticate and data collection. For each data streams there could be 1 authentication call with respect to interval (default 10s). Here is the performing request logs for data streams.

Also here are the logs after Postman calls from citrix adc,

Dec 18 06:00:10 192.0.0.1  12/18/2024:06:00:10 GMT f29fabbea6e2 0-PPE-0 : default API CMD_EXECUTED 7402 0 :  User nsroot - Remote_ip 172.20.4.111 - Command "login nsroot "********"" - Status "Success"
Dec 18 06:00:10 192.0.0.1  12/18/2024:06:00:10 GMT f29fabbea6e2 0-PPE-0 : default API CMD_EXECUTED 7403 0 :  User nsroot - Remote_ip 172.20.4.111 - Command "stat lb vserver" - Status "Success"
Dec 18 06:00:10 192.0.0.1  12/18/2024:06:00:10 GMT f29fabbea6e2 0-PPE-0 : default API CMD_EXECUTED 7404 0 :  User nsroot - Remote_ip 172.20.4.111 - Command "logout" - Status "Success"

To reduce the authentication for every interval, we can use the NITRO SESSION authentication mechanism for interface, lbvserver, vpn, system and server data streams.

Here are the logs after creating the sessionID from /nitro/v1/config/login api and then using the sessionID to perform data collection.

Dec 18 06:01:04 192.0.0.1  12/18/2024:06:01:04 GMT f29fabbea6e2 0-PPE-0 : default API CMD_EXECUTED 7412 0 :  User nsroot - Remote_ip 172.20.4.111 - Command "stat interface" - Status "Success"

Implementation

• Currently we are using the httpjson input to collect data from Citrix ADC. To support NITRO SESSION, we need to use CEL input due to conditional operations handling. Hence we need to switch to CEL input from HTTPJSON input.
• Mostly there are no configuration parameter changes for existing user. That means from username and password we can generate the sessionid and using the sessionid we can fetch the data from Citrix ADC.

Reference

• NITRO SESSION
• Default timeout of sessionID could be 30min.

Relates

• [O11y][CItrix ADC] Support NITRO SESSION Authentication mechanism for interface, lbvserver, vpn, system and server data streams #12144