A civic UCS Manager Python job must provision from a template. What is the first constructed authentication hop?
Select an answer to reveal the explanation.
Short Explanation
UCS Manager starts like a locked city vault: aaaLogin hands you a cookie badge, and every later method must show that same badge.
Full Explanation
A civic UCS Manager Python provision job begins with aaaLogin over HTTP(S) XML using name and password. The login response supplies a session cookie that subsequent methods—including instantiate-from-template and config commits—must carry. That cookie hop is the constructed authentication gate for UCS Manager; without it, later XML methods are unauthorized even if template DNs are correct.
Signing each call with an Intersight API-key digest fails because that authentication model belongs to intersight.com, not the UCS Manager VIP XML endpoint. Sending Authorization: Bearer with a static Webex bot token fails by product mix: Webex tokens do not establish a UCS Manager AAA session. Skipping login and passing only the template DN on lsInstantiate methods fails because instantiate still requires an authenticated UCS Manager session; the DN alone is not a credential.
Exam caveat: cookies expire and VIP failover can invalidate a handle mid-job—do not treat a single aaaLogin at process start as infinitely reusable across long municipal batch windows without re-auth or health checks.
Operational check: after aaaLogin, issue a cheap resolve or query with the cookie before instantiate; if the cookie is rejected, re-login and abort cleanly rather than half-applying named profiles across parks blades.