fortios_user_group – Configure user groups in Fortinet’s FortiOS and FortiGate.¶
New in version 2.9.
Synopsis¶
- This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify user feature and group category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.0
Requirements¶
The below requirements are needed on the host that executes this module.
- ansible>=2.9.0
Parameters¶
- access_token - Token-based authentication. Generated from GUI of Fortigate. type: str required: False
- vdom - Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit. type: str default: root
- state - Indicates whether to create or remove the object. type: str required: True choices: present, absent
- user_group - Configure user groups. type: dict
- auth_concurrent_override - Enable/disable overriding the global number of concurrent authentication sessions for this user group. type: str choices: enable, disable
- auth_concurrent_value - Maximum number of concurrent authenticated connections per user (0 - 100). type: int
- authtimeout - Authentication timeout in minutes for this user group. 0 to use the global user setting auth-timeout. type: int
- company - Set the action for the company guest user field. type: str choices: optional, mandatory, disabled
- email - Enable/disable the guest user email address field. type: str choices: disable, enable
- expire - Time in seconds before guest user accounts expire. (1 - 31536000 sec) type: int
- expire_type - Determine when the expiration countdown begins. type: str choices: immediately, first-successful-login
- group_type - Set the group to be for firewall authentication, FSSO, RSSO, or guest users. type: str choices: firewall, fsso-service, rsso, guest
- guest - Guest User. type: list
- comment - Comment. type: str
- company - Set the action for the company guest user field. type: str
- email - Email. type: str
- expiration - Expire time. type: str
- mobile_phone - Mobile phone. type: str
- name - Guest name. type: str
- password - Guest password. type: str
- sponsor - Set the action for the sponsor guest user field. type: str
- user_id - Guest ID. type: str
- http_digest_realm - Realm attribute for MD5-digest authentication. type: str
- id - Group ID. type: int
- match - Group matches. type: list
- group_name - Name of matching group on remote auththentication server. type: str
- id - ID. type: int required: True
- server_name - Name of remote auth server. Source user.radius.name user.ldap.name user.tacacs+.name. type: str
- max_accounts - Maximum number of guest accounts that can be created for this group (0 means unlimited). type: int
- member - Names of users, peers, LDAP severs, or RADIUS servers to add to the user group. type: list
- name - Group member name. Source user.peer.name user.local.name user.radius.name user.tacacs+.name user.ldap.name user.adgrp.name user .pop3.name. type: str required: True
- mobile_phone - Enable/disable the guest user mobile phone number field. type: str choices: disable, enable
- multiple_guest_add - Enable/disable addition of multiple guests. type: str choices: disable, enable
- name - Group name. type: str required: True
- password - Guest user password type. type: str choices: auto-generate, specify, disable
- sms_custom_server - SMS server. Source system.sms-server.name. type: str
- sms_server - Send SMS through FortiGuard or other external server. type: str choices: fortiguard, custom
- sponsor - Set the action for the sponsor guest user field. type: str choices: optional, mandatory, disabled
- sso_attribute_value - Name of the RADIUS user group that this local user group represents. type: str
- user_id - Guest user ID type. type: str choices: email, auto-generate, specify
- user_name - Enable/disable the guest user name entry. type: str choices: disable, enable
Examples¶
- hosts: fortigates
collections:
- fortinet.fortios
connection: httpapi
vars:
vdom: "root"
ansible_httpapi_use_ssl: yes
ansible_httpapi_validate_certs: no
ansible_httpapi_port: 443
tasks:
- name: Configure user groups.
fortios_user_group:
vdom: "{{ vdom }}"
state: "present"
access_token: "<your_own_value>"
user_group:
auth_concurrent_override: "enable"
auth_concurrent_value: "4"
authtimeout: "5"
company: "optional"
email: "disable"
expire: "8"
expire_type: "immediately"
group_type: "firewall"
guest:
-
comment: "Comment."
company: "<your_own_value>"
email: "<your_own_value>"
expiration: "<your_own_value>"
mobile_phone: "<your_own_value>"
name: "default_name_17"
password: "<your_own_value>"
sponsor: "<your_own_value>"
user_id: "<your_own_value>"
http_digest_realm: "<your_own_value>"
id: "22"
match:
-
group_name: "<your_own_value>"
id: "25"
server_name: "<your_own_value> (source user.radius.name user.ldap.name user.tacacs+.name)"
max_accounts: "27"
member:
-
name: "default_name_29 (source user.peer.name user.local.name user.radius.name user.tacacs+.name user.ldap.name user.adgrp.name user.pop3.name)"
mobile_phone: "disable"
multiple_guest_add: "disable"
name: "default_name_32"
password: "auto-generate"
sms_custom_server: "<your_own_value> (source system.sms-server.name)"
sms_server: "fortiguard"
sponsor: "optional"
sso_attribute_value: "<your_own_value>"
user_id: "email"
user_name: "disable"
Return Values¶
Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:
- build - Build number of the fortigate image returned: always type: str sample: 1547
- http_method - Last method used to provision the content into FortiGate returned: always type: str sample: PUT
- http_status - Last result given by FortiGate on last operation applied returned: always type: str sample: 200
- mkey - Master key (id) used in the last call to FortiGate returned: success type: str sample: id
- name - Name of the table used to fulfill the request returned: always type: str sample: urlfilter
- path - Path of the table used to fulfill the request returned: always type: str sample: webfilter
- revision - Internal revision number returned: always type: str sample: 17.0.2.10658
- serial - Serial number of the unit returned: always type: str sample: FGVMEVYYQT3AB5352
- status - Indication of the operation's result returned: always type: str sample: success
- vdom - Virtual domain used returned: always type: str sample: root
- version - Version of the FortiGate returned: always type: str sample: v5.6.3