Add active directory resources (#2)

Author: kuba-mazurkiewicz

README.md

@@ -22,8 +22,7 @@ ise:
         - name: CertificateNotExpired
           type: LibraryConditionAttributes
           is_negate: false
-          dictionary_name: CERTIFICATE
-          attribute_name: Is Expired
+          attribute_name: CERTIFICATE:Is Expired
           operator: equals
           attribute_value: "False"
 ```
@@ -36,6 +35,8 @@ module "ise" {
   version = ">= 0.1.0"
 
   yaml_files = ["network_access_condition.yaml"]
+
+  manage_network_access = true
 }
 ```
 
@@ -44,7 +45,7 @@ module "ise" {
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.0 |
-| <a name="requirement_ise"></a> [ise](#requirement\_ise) | >= 0.1.8 |
+| <a name="requirement_ise"></a> [ise](#requirement\_ise) | >= 0.1.12 |
 | <a name="requirement_local"></a> [local](#requirement\_local) | >= 2.3.0 |
 | <a name="requirement_time"></a> [time](#requirement\_time) | >= 0.10.0 |
 | <a name="requirement_utils"></a> [utils](#requirement\_utils) | >= 0.2.5 |
@@ -72,6 +73,9 @@ module "ise" {
 
 | Name | Type |
 |------|------|
+| [ise_active_directory_add_groups.active_directory_groups](https://registry.terraform.io/providers/CiscoDevNet/ise/latest/docs/resources/active_directory_add_groups) | resource |
+| [ise_active_directory_join_domain_with_all_nodes.active_directory_join_domain_with_all_nodes](https://registry.terraform.io/providers/CiscoDevNet/ise/latest/docs/resources/active_directory_join_domain_with_all_nodes) | resource |
+| [ise_active_directory_join_point.active_directory_join_point](https://registry.terraform.io/providers/CiscoDevNet/ise/latest/docs/resources/active_directory_join_point) | resource |
 | [ise_allowed_protocols.allowed_protocols](https://registry.terraform.io/providers/CiscoDevNet/ise/latest/docs/resources/allowed_protocols) | resource |
 | [ise_allowed_protocols_tacacs.allowed_protocols_tacacs](https://registry.terraform.io/providers/CiscoDevNet/ise/latest/docs/resources/allowed_protocols_tacacs) | resource |
 | [ise_authorization_profile.authorization_profile](https://registry.terraform.io/providers/CiscoDevNet/ise/latest/docs/resources/authorization_profile) | resource |
@@ -305,6 +309,7 @@ module "ise" {
 | [time_sleep.device_admin_policy_object_wait](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
 | [time_sleep.network_device_group_wait](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
 | [time_sleep.sgt_wait](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
+| [ise_active_directory_groups_by_domain.all_groups](https://registry.terraform.io/providers/CiscoDevNet/ise/latest/docs/data-sources/active_directory_groups_by_domain) | data source |
 | [ise_device_admin_condition.device_admin_condition](https://registry.terraform.io/providers/CiscoDevNet/ise/latest/docs/data-sources/device_admin_condition) | data source |
 | [ise_device_admin_condition.device_admin_condition_circular](https://registry.terraform.io/providers/CiscoDevNet/ise/latest/docs/data-sources/device_admin_condition) | data source |
 | [ise_endpoint_identity_group.endpoint_identity_group](https://registry.terraform.io/providers/CiscoDevNet/ise/latest/docs/data-sources/endpoint_identity_group) | data source |
@@ -317,4 +322,4 @@ module "ise" {
 ## Modules
 
 No modules.
-<!-- END_TF_DOCS -->
+<!-- END_TF_DOCS -->

examples/network_access_condition/README.md

@@ -30,8 +30,7 @@ ise:
         - name: CertificateNotExpired
           type: LibraryConditionAttributes
           is_negate: false
-          dictionary_name: CERTIFICATE
-          attribute_name: Is Expired
+          attribute_name: CERTIFICATE:Is Expired
           operator: equals
           attribute_value: "False"
 ```
@@ -43,6 +42,8 @@ module "ise" {
   source  = "netascode/nac-ise/ise"
   version = ">= 0.1.0"
 
+  manage_network_access = true
+
   yaml_files = ["network_access_condition.yaml"]
 }
 ```

examples/network_access_condition/main.tf

@@ -3,4 +3,6 @@ module "ise" {
   version = ">= 0.1.0"
 
   yaml_files = ["network_access_condition.yaml"]
+
+  manage_network_access = true
 }

examples/network_access_condition/network_access_condition.yaml

@@ -6,7 +6,6 @@ ise:
         - name: CertificateNotExpired
           type: LibraryConditionAttributes
           is_negate: false
-          dictionary_name: CERTIFICATE
-          attribute_name: Is Expired
+          attribute_name: CERTIFICATE:Is Expired
           operator: equals
           attribute_value: "False"

ise_device_admin.tf

@@ -53,3 +53,108 @@ resource "ise_certificate_authentication_profile" "certificate_authentication_pr
   match_mode                   = try(each.value.match_mode, local.defaults.ise.identity_management.certificate_authentication_profiles.description, null)
   username_from                = try(each.value.username_from, local.defaults.ise.identity_management.certificate_authentication_profiles.description, null)
 }
+
+resource "ise_active_directory_join_point" "active_directory_join_point" {
+  for_each = { for ad in try(local.ise.identity_management.active_directories, []) : ad.name => ad if var.manage_identity_management }
+
+  name                       = each.key
+  description                = try(each.value.description, local.defaults.ise.identity_management.active_directories.description, null)
+  domain                     = try(each.value.domain, local.defaults.ise.identity_management.active_directories.domain, null)
+  ad_scopes_names            = try(each.value.ad_scopes_names, local.defaults.ise.identity_management.active_directories.ad_scopes_names, null)
+  enable_domain_allowed_list = try(each.value.enable_domain_allowed_list, local.defaults.ise.identity_management.active_directories.enable_domain_allowed_list, null)
+  groups                     = []
+  attributes = [for attr in try(each.value.attributes, []) : {
+    name          = try(attr.name, null)
+    type          = try(attr.type, local.defaults.ise.identity_management.active_directories.attributes.type, null)
+    internal_name = try(attr.internal_name, local.defaults.ise.identity_management.active_directories.attributes.internal_name, null)
+    default_value = try(attr.default_value, local.defaults.ise.identity_management.active_directories.attributes.default_value, null)
+  }]
+  rewrite_rules = [for rule in try(each.value.rewrite_rules, []) : {
+    row_id         = try(rule.row_id, local.defaults.ise.identity_management.active_directories.rewrite_rules.row_id, null)
+    rewrite_match  = try(rule.rewrite_match, local.defaults.ise.identity_management.active_directories.rewrite_rules.rewrite_match, null)
+    rewrite_result = try(rule.rewrite_result, local.defaults.ise.identity_management.active_directories.rewrite_rules.rewrite_result, null)
+  }]
+  enable_rewrites                   = try(each.value.enable_rewrites, local.defaults.ise.identity_management.active_directories.enable_rewrites, null)
+  enable_pass_change                = try(each.value.enable_pass_change, local.defaults.ise.identity_management.active_directories.enable_pass_change, null)
+  enable_machine_auth               = try(each.value.enable_machine_auth, local.defaults.ise.identity_management.active_directories.enable_machine_auth, null)
+  enable_machine_access             = try(each.value.enable_machine_access, local.defaults.ise.identity_management.active_directories.enable_machine_access, null)
+  enable_dialin_permission_check    = try(each.value.enable_dialin_permission_check, local.defaults.ise.identity_management.active_directories.enable_dialin_permission_check, null)
+  plaintext_auth                    = try(each.value.plaintext_auth, local.defaults.ise.identity_management.active_directories.plaintext_auth, null)
+  aging_time                        = try(each.value.aging_time, local.defaults.ise.identity_management.active_directories.aging_time, null)
+  enable_callback_for_dialin_client = try(each.value.enable_callback_for_dialin_client, local.defaults.ise.identity_management.active_directories.enable_callback_for_dialin_client, null)
+  identity_not_in_ad_behaviour      = try(each.value.identity_not_in_ad_behaviour, local.defaults.ise.identity_management.active_directories.identity_not_in_ad_behaviour, null)
+  unreachable_domains_behaviour     = try(each.value.unreachable_domains_behaviour, local.defaults.ise.identity_management.active_directories.unreachable_domains_behaviour, null)
+  schema                            = try(each.value.schema, local.defaults.ise.identity_management.active_directories.schema, null)
+  first_name                        = try(each.value.first_name, local.defaults.ise.identity_management.active_directories.first_name, null)
+  department                        = try(each.value.department, local.defaults.ise.identity_management.active_directories.department, null)
+  last_name                         = try(each.value.last_name, local.defaults.ise.identity_management.active_directories.last_name, null)
+  organizational_unit               = try(each.value.organizational_unit, local.defaults.ise.identity_management.active_directories.organizational_unit, null)
+  job_title                         = try(each.value.job_title, local.defaults.ise.identity_management.active_directories.job_title, null)
+  locality                          = try(each.value.locality, local.defaults.ise.identity_management.active_directories.locality, null)
+  email                             = try(each.value.email, local.defaults.ise.identity_management.active_directories.email, null)
+  state_or_province                 = try(each.value.state_or_province, local.defaults.ise.identity_management.active_directories.state_or_province, null)
+  telephone                         = try(each.value.telephone, local.defaults.ise.identity_management.active_directories.telephone, null)
+  country                           = try(each.value.country, local.defaults.ise.identity_management.active_directories.country, null)
+  street_address                    = try(each.value.street_address, local.defaults.ise.identity_management.active_directories.street_address, null)
+  enable_failed_auth_protection     = try(each.value.enable_failed_auth_protection, local.defaults.ise.identity_management.active_directories.enable_failed_auth_protection, null)
+  failed_auth_threshold             = try(each.value.failed_auth_threshold, local.defaults.ise.identity_management.active_directories.failed_auth_threshold, null)
+  auth_protection_type              = try(each.value.auth_protection_type, local.defaults.ise.identity_management.active_directories.auth_protection_type, null)
+}
+
+resource "ise_active_directory_join_domain_with_all_nodes" "active_directory_join_domain_with_all_nodes" {
+  for_each = { for ad in try(local.ise.identity_management.active_directories, []) : ad.name => ad if var.manage_identity_management }
+
+  join_point_id = ise_active_directory_join_point.active_directory_join_point[each.key].id
+  additional_data = [
+    {
+      name  = "username"
+      value = try(each.value.ad_username, local.defaults.ise.identity_management.active_directories.ad_username, null)
+    },
+    {
+      name  = "password"
+      value = try(each.value.ad_password, local.defaults.ise.identity_management.active_directories.ad_password, null)
+    }
+  ]
+
+  depends_on = [ise_active_directory_join_point.active_directory_join_point]
+}
+
+data "ise_active_directory_groups_by_domain" "all_groups" {
+  for_each = { for ad in try(local.ise.identity_management.active_directories, []) : ad.name => ad if var.manage_identity_management }
+
+  join_point_id = ise_active_directory_join_point.active_directory_join_point[each.key].id
+  domain        = try(each.value.domain, local.defaults.ise.identity_management.active_directories.domain, null)
+
+  depends_on = [ise_active_directory_join_point.active_directory_join_point, ise_active_directory_join_domain_with_all_nodes.active_directory_join_domain_with_all_nodes]
+}
+
+locals {
+  active_directory_groups_all = {
+    for k, v in data.ise_active_directory_groups_by_domain.all_groups :
+    k => { for group in v.groups : group.name => group } if var.manage_identity_management
+  }
+
+  active_directory_groups = {
+    for ad in try(local.ise.identity_management.active_directories, []) : ad.name => [
+      for group in ad.groups : {
+        name = group
+        type = try(local.active_directory_groups_all[ad.name][group].type, null)
+        sid  = try(local.active_directory_groups_all[ad.name][group].sid, null)
+      }
+    ] if var.manage_identity_management
+  }
+}
+
+resource "ise_active_directory_add_groups" "active_directory_groups" {
+  for_each = { for ad in try(local.ise.identity_management.active_directories, []) : ad.name => ad if var.manage_identity_management }
+
+  join_point_id              = ise_active_directory_join_point.active_directory_join_point[each.key].id
+  name                       = ise_active_directory_join_point.active_directory_join_point[each.key].name
+  description                = ise_active_directory_join_point.active_directory_join_point[each.key].description
+  domain                     = ise_active_directory_join_point.active_directory_join_point[each.key].domain
+  ad_scopes_names            = ise_active_directory_join_point.active_directory_join_point[each.key].ad_scopes_names
+  enable_domain_allowed_list = ise_active_directory_join_point.active_directory_join_point[each.key].enable_domain_allowed_list
+  groups                     = try(local.active_directory_groups[each.key], local.defaults.ise.identity_management.active_directories.groups, null)
+
+  depends_on = [ise_active_directory_join_point.active_directory_join_point, ise_active_directory_join_domain_with_all_nodes.active_directory_join_domain_with_all_nodes]
+}