intersight_ldap_policy

Manage LDAP Policies for Cisco Intersight

Collection: cisco.intersight

Full Name: cisco.intersight.intersight_ldap_policy

Synopsis

Manage LDAP Policies for Cisco Intersight

Parameters

Name	Type	Required	Default	Description
api_private_key	string			Filename (absolute path) or string of PEM formatted private key data to be used for Intersight API authentication. If a string is used, Ansible vault should be used to encrypt string data. Ex. ansible-vault encrypt_string –vault-id tme@/Users/dsoper/Documents/vault_password_file ‘—–BEGIN EC PRIVATE KEY—– —–END EC PRIVATE KEY—–’ If not set, the value of the INTERSIGHT_API_PRIVATE_KEY environment variable is used. Required if I(api_bearer_token) is not provided. Secret value; omitted from logs and results.
api_uri	string		`https://intersight.com/api/v1`	URI used to access the Intersight API. If not set, the value of the INTERSIGHT_API_URI environment variable is used.
api_key_id	string			Public API Key ID associated with the private key. If not set, the value of the INTERSIGHT_API_KEY_ID environment variable is used. Required if I(api_bearer_token) is not provided.
api_bearer_token	string			Bearer token for OAuth2 authentication with the Intersight API. When provided, I(api_key_id) and I(api_private_key) are not required and the C(cryptography) Python library is not needed. If not set, the value of the INTERSIGHT_API_BEARER_TOKEN environment variable is used. Secret value; omitted from logs and results.
validate_certs	bool		`true`	Boolean control for verifying the api_uri TLS certificate
use_proxy	bool		`true`	If C(no), it will not use a proxy, even if one is defined in an environment variable on the target hosts.
state	string		`present`	If C(present), will verify the resource is present and will create if needed. If C(absent), will verify the resource is absent and will delete if needed. Choices: `present`, `absent`
organization	string		`default`	The name of the Organization this resource is assigned to. Policies created within a Custom Organization are applicable only to devices in the same Organization. Use ‘default’ for the default organization.
name	string	yes		The name assigned to the LDAP Policy. Must be unique within the organization. The name must be between 1 and 64 alphanumeric characters, allowing special characters :-_.
description	string			The user-defined description for the LDAP Policy. Description can contain letters(a-z, A-Z), numbers(0-9), hyphen(-), period(.), colon(:), or an underscore(_).
tags	list			List of tags in Key: Value: format.
enable_ldap	bool		`true`	If enabled, LDAP server performs authentication.
base_dn	string			Base Distinguished Name (DN). Starting point from where server will search for users and groups. Required when state is present.
domain	string			The IPv4 domain that all users must be in. Required when state is present.
timeout	int		`0`	LDAP authentication timeout duration, in seconds. Valid range is 0-180.
enable_encryption	bool		`false`	If enabled, the endpoint encrypts all information it sends to the LDAP server.
bind_method	string		`logincredentials`	Authentication method to access LDAP servers. C(logincredentials) uses the user credentials entered at login. C(anonymous) uses no credentials to access the LDAP server. C(configuredcredentials) uses a specific set of credentials configured for the LDAP server. Choices: `logincredentials`, `anonymous`, `configuredcredentials`
bind_dn	string			Distinguished Name (DN) of the user, that is used to authenticate against LDAP servers. Required when bind_method is configuredcredentials.
password	string			The password of the user for initial bind process. Can have any character except spaces, tabs, line breaks. Cannot be more than 254 characters. Required when bind_method is configuredcredentials. Secret value; omitted from logs and results.
filter	string			Criteria to identify entries in search requests. Required when state is present.
group_attribute	string			Groups to which an LDAP entry belongs. Required when state is present.
attribute	string			Role and locale information of the user. Required when state is present.
group_authorization	bool		`false`	If enabled, user authorization is also done at the group level for LDAP users not in the local user database.
nested_group_search	bool		`false`	If enabled, an extended search walks the chain of ancestry all the way to the root. Returns all the groups and subgroups, each of those groups belong to recursively.
nested_group_search_depth	int		`128`	Search depth to look for a nested LDAP group in an LDAP group map. Valid range is 1-128. Only applicable when nested_group_search is true.
enable_dns	bool		`false`	Enables DNS to access LDAP servers. When enabled, LDAP providers cannot be specified (DNS discovery is used instead). When disabled, at least one LDAP provider must be configured.
dns_source	string		`extracted`	Source of the domain name used for the DNS SRV request. C(extracted) extracts the domain name from the login ID entered by the user. C(configured) uses the configured search domain. C(configuredextracted) uses configured search domain first, then extracted. Only applicable when enable_dns is true. Choices: `extracted`, `configured`, `configuredextracted`
search_domain	string			Domain name that acts as a source for a DNS query. Required when dns_source is configured or configuredextracted.
search_forest	string			Forest name that acts as a source for a DNS query. Required when dns_source is configured or configuredextracted.
user_search_precedence	string		`localuserdb`	Search precedence between local user database and LDAP user database. C(localuserdb) searches local user database first. C(ldapuserdb) searches LDAP user database first. Choices: `localuserdb`, `ldapuserdb`
ldap_groups	list			List of LDAP groups to be created and attached to the LDAP policy. Each group defines the mapping between LDAP server groups and Intersight roles. Nested options: name (str) required; state (str) default=present; group_dn (str); domain (str); role (str) default=admin
ldap_providers	list			List of LDAP providers (servers) to be created and attached to the LDAP policy. Providers define the LDAP servers to connect to. Cannot be specified when enable_dns is true (DNS discovery is used instead). Required when enable_dns is false (at least one provider must be specified). Nested options: server (str) required; state (str) default=present; port (int) default=389; vendor (str) default=openldap

Example

yaml

- cisco.intersight.intersight_ldap_policy:
    api_key_id: '{{ api_key_id }}'
    api_private_key: '{{ api_private_key }}'
    attribute: CiscoAvPair
    base_dn: dc=example,dc=com
    bind_method: logincredentials
    description: LDAP policy using DNS for server discovery
    dns_source: configured
    domain: example.com
    enable_dns: true
    enable_encryption: true
    enable_ldap: true
    filter: sAMAccountName
    group_attribute: memberOf
    group_authorization: true
    ldap_groups:
        - domain: example.com
          group_dn: cn=admins,ou=groups,dc=example,dc=com
          name: admin-group
          role: admin
        - group_dn: cn=readers,ou=groups,dc=example,dc=com
          name: readonly-group
          role: readonly
    name: ldap-dns-policy
    nested_group_search: true
    nested_group_search_depth: 64
    organization: default
    search_domain: example.com
    search_forest: example.com
    state: present
    tags:
        - Key: Environment
          Value: Production
    timeout: 30
    user_search_precedence: localuserdb
  name: Create LDAP Policy with DNS enabled

- cisco.intersight.intersight_ldap_policy:
    api_key_id: '{{ api_key_id }}'
    api_private_key: '{{ api_private_key }}'
    attribute: CiscoAvPair
    base_dn: company
    bind_method: anonymous
    description: LDAP policy with specific servers
    domain: company.local
    enable_dns: false
    enable_encryption: false
    enable_ldap: true
    filter: sAMAccountName
    group_attribute: memberOf
    group_authorization: false
    ldap_groups:
        - group_dn: company
          name: users-group
          role: user
    ldap_providers:
        - port: 389
          server: 10.10.10.10
          vendor: openldap
        - port: 389
          server: 10.10.10.11
          vendor: openldap
    name: ldap-provider-policy
    nested_group_search: false
    organization: default
    state: present
    timeout: 0
    user_search_precedence: localuserdb
  name: Create LDAP Policy with providers

- cisco.intersight.intersight_ldap_policy:
    api_key_id: '{{ api_key_id }}'
    api_private_key: '{{ api_private_key }}'
    attribute: description
    base_dn: dc=corp,dc=net
    bind_dn: cn=admin,dc=corp,dc=net
    bind_method: configuredcredentials
    description: LDAP policy with configured bind credentials
    domain: corp.net
    enable_dns: false
    enable_encryption: true
    enable_ldap: true
    filter: uid
    group_attribute: gidNumber
    group_authorization: true
    ldap_groups:
        - domain: corp.net
          group_dn: cn=administrators,ou=groups,dc=corp,dc=net
          name: administrators
          role: admin
    ldap_providers:
        - port: 636
          server: ldap.corp.net
          vendor: msad
    name: ldap-configured-creds
    nested_group_search: true
    nested_group_search_depth: 128
    organization: default
    password: SecurePassword123
    state: present
    timeout: 60
    user_search_precedence: ldapuserdb
  name: Create LDAP Policy with configured credentials

- cisco.intersight.intersight_ldap_policy:
    api_key_id: '{{ api_key_id }}'
    api_private_key: '{{ api_private_key }}'
    attribute: CiscoAvPair
    base_dn: dc=example,dc=com
    description: Updated LDAP policy
    domain: example.com
    enable_dns: true
    enable_ldap: true
    filter: sAMAccountName
    group_attribute: memberOf
    ldap_groups:
        - group_dn: cn=admins,ou=groups,dc=example,dc=com
          name: admin-group
          role: admin
          state: present
        - name: old-group
          state: absent
        - group_dn: cn=new,ou=groups,dc=example,dc=com
          name: new-group
          role: user
          state: present
    name: ldap-dns-policy
    organization: default
    state: present
  name: Update LDAP Policy - manage group states

- cisco.intersight.intersight_ldap_policy:
    api_key_id: '{{ api_key_id }}'
    api_private_key: '{{ api_private_key }}'
    name: old-ldap-policy
    state: absent
  name: Delete LDAP Policy