fortinet.fortimanager.fmgr_user_radius_dynamicmapping module – Configure RADIUS server entries.
Note
This module is part of the fortinet.fortimanager collection (version 2.1.5).
You might already have this collection installed if you are using the ansible package.
It is not included in ansible-core.
To check whether it is installed, run ansible-galaxy collection list.
To install it, use: ansible-galaxy collection install fortinet.fortimanager.
To use it in a playbook, specify: fortinet.fortimanager.fmgr_user_radius_dynamicmapping.
New in version 2.10: of fortinet.fortimanager
Synopsis
This module is able to configure a FortiManager device.
Examples include all parameters and values which need to be adjusted to data sources before usage.
Parameters
Parameter |
Comments |
|---|---|
the parameter (adom) in requested url |
|
only set to True when module schema diffs with FortiManager API structure, module continues to execute without validating parameters Choices:
|
|
Enable/Disable logging for task Choices:
|
|
The overridden method for the underlying Json RPC request Choices:
|
|
the parameter (radius) in requested url |
|
the rc codes list with which the conditions to fail will be overriden |
|
the rc codes list with which the conditions to succeed will be overriden |
|
the directive to create, update or delete an object Choices:
|
|
the top level parameters set |
|
no description |
|
Name. |
|
Vdom. |
|
no description |
|
ID (0 - 4294967295). |
|
Specify outgoing interface to reach server. |
|
Specify how to select outgoing interface to reach server. Choices:
|
|
RADIUS accounting port number. |
|
no description |
|
{<name_str|ip_str>} Server CN domain name or IP. |
|
Source IP address for communications to the RADIUS server. |
|
Status. Choices:
|
|
Enable/disable sending of accounting messages to all configured servers (default = disable). Choices:
|
|
Time in seconds between each accounting interim update message. |
|
Enable/disable automatically including this RADIUS server in all user groups. Choices:
|
|
Authentication methods/protocols permitted for this RADIUS server. Choices:
|
|
no description |
|
Dp-Carrier-Endpoint-Attribute. Choices:
|
|
Dp-Carrier-Endpoint-Block-Attribute. Choices:
|
|
Dp-Context-Timeout. |
|
Dp-Flush-Ip-Session. Choices:
|
|
Dp-Hold-Time. |
|
Dp-Http-Header. |
|
Dp-Http-Header-Fallback. Choices:
|
|
Dp-Http-Header-Status. Choices:
|
|
Dp-Http-Header-Suppress. Choices:
|
|
no description Choices:
|
|
Dp-Log-Period. |
|
Dp-Mem-Percent. |
|
Dp-Profile-Attribute. Choices:
|
|
Dp-Profile-Attribute-Key. |
|
Dp-Radius-Response. Choices:
|
|
Dp-Radius-Server-Port. |
|
no description |
|
Dp-Validate-Request-Secret. Choices:
|
|
Dynamic-Profile. Choices:
|
|
Endpoint-Translation. Choices:
|
|
Ep-Carrier-Endpoint-Convert-Hex. Choices:
|
|
Ep-Carrier-Endpoint-Header. |
|
Ep-Carrier-Endpoint-Header-Suppress. Choices:
|
|
Ep-Carrier-Endpoint-Prefix. Choices:
|
|
Ep-Carrier-Endpoint-Prefix-Range-Max. |
|
Ep-Carrier-Endpoint-Prefix-Range-Min. |
|
Ep-Carrier-Endpoint-Prefix-String. |
|
Ep-Carrier-Endpoint-Source. Choices:
|
|
Ep-Ip-Header. |
|
Ep-Ip-Header-Suppress. Choices:
|
|
Ep-Missing-Header-Fallback. Choices:
|
|
Ep-Profile-Query-Type. Choices:
|
|
Group-Override-Attr-Type. Choices:
|
|
Enable/disable compatibility with the H3C, a mechanism that performs security checking for authentication. Choices:
|
|
Specify outgoing interface to reach server. |
|
Specify how to select outgoing interface to reach server. Choices:
|
|
IP address used to communicate with the RADIUS server and used as NAS-IP-Address and Called-Station-ID attributes. |
|
Password encoding. Choices:
|
|
Enable/disable password renewal. Choices:
|
|
Enable to allow a mechanism to change the attributes of an authentication, authorization, and accounting session after it is a… Choices:
|
|
RADIUS service port number. |
|
Enable/disable RADIUS based single sign on feature. Choices:
|
|
Time in seconds before the logged out user is removed from the “user context list” of logged on users. |
|
RADIUS attributes used to extract the user end point identifer from the RADIUS Start record. Choices:
|
|
RADIUS attributes used to block a user. Choices:
|
|
Enable/disable the replacement of old IP addresses with new ones for the same endpoint on RADIUS accounting Start messages. Choices:
|
|
Enable/disable flushing user IP sessions on RADIUS accounting Stop messages. Choices:
|
|
no description Choices:
|
|
Time interval in seconds that group event log messages will be generated for dynamic profile events. |
|
Enable/disable sending RADIUS response packets after receiving Start and Stop records. Choices:
|
|
UDP port to listen on for RADIUS Start and Stop records. |
|
no description |
|
Enable/disable validating the RADIUS request shared secret in the Start or End record. Choices:
|
|
no description |
|
{<name_str|ip_str>} secondary RADIUS CN domain name or IP. |
|
no description |
|
Primary RADIUS server CN domain name or IP address. |
|
Source IP address for communications to the RADIUS server. |
|
RADIUS attribute that contains the profile group name to be extracted from the RADIUS Start record. Choices:
|
|
Key prefix for SSO group value in the SSO attribute. |
|
Enable/disable override old attribute value with new value for the same endpoint. Choices:
|
|
Switch-Controller-Acct-Fast-Framedip-Detect. |
|
no description Choices:
|
|
no description |
|
{<name_str|ip_str>} tertiary RADIUS CN domain name or IP. |
|
Time in seconds between re-sending authentication requests. |
|
Use-Group-For-Profile. Choices:
|
|
Enable/disable using management VDOM to send requests. Choices:
|
|
Enable/disable case sensitive user names. Choices:
|
|
the adom to lock for FortiManager running in workspace mode, the value can be global and others including root |
|
the maximum time in seconds to wait for other user to release the workspace lock Default: 300 |
Notes
Note
Running in workspace locking mode is supported in this FortiManager module, the top level parameters workspace_locking_adom and workspace_locking_timeout help do the work.
To create or update an object, use state present directive.
To delete an object, use state absent directive.
Normally, running one module can fail when a non-zero rc is returned. you can also override the conditions to fail or succeed with parameters rc_failed and rc_succeeded
Examples
- name: gathering fortimanager facts
hosts: fortimanager00
gather_facts: no
connection: httpapi
collections:
- fortinet.fortimanager
vars:
ansible_httpapi_use_ssl: True
ansible_httpapi_validate_certs: False
ansible_httpapi_port: 443
tasks:
- name: retrieve all the dynamic mappings of RADIUS server
fmgr_fact:
facts:
selector: 'user_radius_dynamicmapping'
params:
adom: 'ansible'
radius: 'ansible-test-radius' # name
dynamic_mapping: ''
- hosts: fortimanager00
collections:
- fortinet.fortimanager
connection: httpapi
vars:
ansible_httpapi_use_ssl: True
ansible_httpapi_validate_certs: False
ansible_httpapi_port: 443
tasks:
- name: Configure dynamic mappings of RADIUS server
fmgr_user_radius_dynamicmapping:
bypass_validation: False
adom: ansible
radius: ansible-test-radius # name
state: present
user_radius_dynamicmapping:
_scope:
-
name: FGT_AWS # need a valid device name
vdom: root # need a valid vdom name under the device
server: ansible
timeout: 100
Return Values
Common return values are documented here, the following are the fields unique to this module:
Key |
Description |
|---|---|
The full url requested Returned: always Sample: “/sys/login/user” |
|
The status of api request Returned: always Sample: 0 |
|
The descriptive message of the api response Returned: always Sample: “OK.” |
Authors
Link Zheng (@chillancezen)
Jie Xue (@JieX19)
Frank Shen (@fshen01)
Hongbin Lu (@fgtdev-hblu)