source:	fortios_user_group.py
orphan:

fortios_user_group -- Configure user groups in Fortinet's FortiOS and FortiGate.

.. versionadded:: 2.0.0

Synopsis
Requirements
Tips
FortiOS Version Compatibility
Parameters
Notes
Examples
Return Values
Status
Authors

Synopsis

This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the user to set and modify user feature and group category. Examples include all parameters and values need to be adjusted to datasources before usage. Tested with FOS v6.0.0

Requirements

The below requirements are needed on the host that executes this module.

ansible>=2.15

Tips

Using member operation to add an element to an existing object.

FortiOS Version Compatibility

Supported Version Ranges: v6.0.0 -> 7.4.3

Parameters

access_token - Token-based authentication. Generated from GUI of Fortigate. type: str required: false
enable_log - Enable/Disable logging for task. type: bool required: false default: False
vdom - Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit. type: str default: root
member_path - Member attribute path to operate on. type: str
member_state - Add or delete a member under specified attribute path. type: str choices: present, absent
state - Indicates whether to create or remove the object. type: str required: true choices: present, absent
user_group - Configure user groups. type: dict more...

Supported Version Ranges

user_group v6.0.0 -> 7.4.3

auth_concurrent_override - Enable/disable overriding the global number of concurrent authentication sessions for this user group. type: str choices: enable, disable more...

Supported Version Ranges

auth_concurrent_override v6.0.0 -> 7.4.3

[enable] v6.0.0 -> 7.4.3
[disable] v6.0.0 -> 7.4.3
auth_concurrent_value - Maximum number of concurrent authenticated connections per user (0 - 100). type: int more...

Supported Version Ranges

auth_concurrent_value v6.0.0 -> 7.4.3
authtimeout - Authentication timeout in minutes for this user group. 0 to use the global user setting auth-timeout. type: int more...

Supported Version Ranges

authtimeout v6.0.0 -> 7.4.3
company - Set the action for the company guest user field. type: str choices: optional, mandatory, disabled more...

Supported Version Ranges

company v6.0.0 -> 7.4.3

[optional] v6.0.0 -> 7.4.3
[mandatory] v6.0.0 -> 7.4.3
[disabled] v6.0.0 -> 7.4.3
email - Enable/disable the guest user email address field. type: str choices: disable, enable more...

Supported Version Ranges

email v6.0.0 -> 7.4.3

[disable] v6.0.0 -> 7.4.3
[enable] v6.0.0 -> 7.4.3
expire - Time in seconds before guest user accounts expire (1 - 31536000). type: int more...

Supported Version Ranges

expire v6.0.0 -> 7.4.3
expire_type - Determine when the expiration countdown begins. type: str choices: immediately, first-successful-login more...

Supported Version Ranges

expire_type v6.0.0 -> 7.4.3

[immediately] v6.0.0 -> 7.4.3
[first-successful-login] v6.0.0 -> 7.4.3
group_type - Set the group to be for firewall authentication, FSSO, RSSO, or guest users. type: str choices: firewall, fsso-service, rsso, guest more...

Supported Version Ranges

group_type v6.0.0 -> 7.4.3

[firewall] v6.0.0 -> 7.4.3
[fsso-service] v6.0.0 -> 7.4.3
[rsso] v6.0.0 -> 7.4.3
[guest] v6.0.0 -> 7.4.3
guest - Guest User. type: list member_path: guest:id more...

Supported Version Ranges

guest v6.0.0 -> 7.4.3

comment - Comment. type: str more...

Supported Version Ranges

comment v6.0.0 -> 7.4.3
company - Set the action for the company guest user field. type: str more...

Supported Version Ranges

company v6.0.0 -> 7.4.3
email - Email. type: str more...

Supported Version Ranges

email v6.0.0 -> 7.4.3
expiration - Expire time. type: str more...

Supported Version Ranges

expiration v6.0.0 -> 7.4.3
id - Guest ID. see Notes. type: int required: true more...

Supported Version Ranges

id v6.2.0 -> 7.4.3
mobile_phone - Mobile phone. type: str more...

Supported Version Ranges

mobile_phone v6.0.0 -> 7.4.3
name - Guest name. type: str more...

Supported Version Ranges

name v6.0.0 -> 7.4.3
password - Guest password. type: str more...

Supported Version Ranges

password v6.0.0 -> 7.4.3
sponsor - Set the action for the sponsor guest user field. type: str more...

Supported Version Ranges

sponsor v6.0.0 -> 7.4.3
user_id - Guest ID. type: str more...

Supported Version Ranges

user_id v6.0.0 -> 7.4.3

http_digest_realm - Realm attribute for MD5-digest authentication. type: str more...

Supported Version Ranges

http_digest_realm v6.0.0 -> 7.4.3
id - Group ID. type: int more...

Supported Version Ranges

id v6.0.0 -> v7.0.5 v7.2.0 -> v7.2.0
match - Group matches. type: list member_path: match:id more...

Supported Version Ranges

match v6.0.0 -> 7.4.3

group_name - Name of matching user or group on remote authentication server. type: str more...

Supported Version Ranges

group_name v6.0.0 -> 7.4.3
id - ID. see Notes. type: int required: true more...

Supported Version Ranges

id v6.0.0 -> 7.4.3
server_name - Name of remote auth server. Source user.radius.name user.ldap.name user.tacacs+.name user.saml.name user .external-identity-provider.name. type: str more...

Supported Version Ranges

server_name v6.0.0 -> 7.4.3

max_accounts - Maximum number of guest accounts that can be created for this group (0 means unlimited). type: int more...

Supported Version Ranges

max_accounts v6.0.0 -> 7.4.3
member - Names of users, peers, LDAP severs, RADIUS servers or external idp servers to add to the user group. type: list member_path: member:name more...

Supported Version Ranges

member v6.0.0 -> 7.4.3

name - Group member name. Source user.peer.name user.local.name user.radius.name user.tacacs+.name user.ldap.name user.saml.name user .external-identity-provider.name user.adgrp.name user.pop3.name user.certificate.name. type: str required: true more...

Supported Version Ranges

name v6.0.0 -> 7.4.3

mobile_phone - Enable/disable the guest user mobile phone number field. type: str choices: disable, enable more...

Supported Version Ranges

mobile_phone v6.0.0 -> 7.4.3

[disable] v6.0.0 -> 7.4.3
[enable] v6.0.0 -> 7.4.3
multiple_guest_add - Enable/disable addition of multiple guests. type: str choices: disable, enable more...

Supported Version Ranges

multiple_guest_add v6.0.0 -> 7.4.3

[disable] v6.0.0 -> 7.4.3
[enable] v6.0.0 -> 7.4.3
name - Group name. type: str required: true more...

Supported Version Ranges

name v6.0.0 -> 7.4.3
password - Guest user password type. type: str choices: auto-generate, specify, disable more...

Supported Version Ranges

password v6.0.0 -> 7.4.3

[auto-generate] v6.0.0 -> 7.4.3
[specify] v6.0.0 -> 7.4.3
[disable] v6.0.0 -> 7.4.3
sms_custom_server - SMS server. Source system.sms-server.name. type: str more...

Supported Version Ranges

sms_custom_server v6.0.0 -> 7.4.3
sms_server - Send SMS through FortiGuard or other external server. type: str choices: fortiguard, custom more...

Supported Version Ranges

sms_server v6.0.0 -> 7.4.3

[fortiguard] v6.0.0 -> 7.4.3
[custom] v6.0.0 -> 7.4.3
sponsor - Set the action for the sponsor guest user field. type: str choices: optional, mandatory, disabled more...

Supported Version Ranges

sponsor v6.0.0 -> 7.4.3

[optional] v6.0.0 -> 7.4.3
[mandatory] v6.0.0 -> 7.4.3
[disabled] v6.0.0 -> 7.4.3
sso_attribute_value - Name of the RADIUS user group that this local user group represents. type: str more...

Supported Version Ranges

sso_attribute_value v6.0.0 -> 7.4.3
user_id - Guest user ID type. type: str choices: email, auto-generate, specify more...

Supported Version Ranges

user_id v6.0.0 -> 7.4.3

[email] v6.0.0 -> 7.4.3
[auto-generate] v6.0.0 -> 7.4.3
[specify] v6.0.0 -> 7.4.3
user_name - Enable/disable the guest user name entry. type: str choices: disable, enable more...

Supported Version Ranges

user_name v6.0.0 -> 7.4.3

[disable] v6.0.0 -> 7.4.3
[enable] v6.0.0 -> 7.4.3

Notes

Note

Legacy fortiosapi has been deprecated, httpapi is the preferred way to run playbooks

Examples

- name: Configure user groups.
  fortinet.fortios.fortios_user_group:
      vdom: "{{ vdom }}"
      state: "present"
      access_token: "<your_own_value>"
      user_group:
          auth_concurrent_override: "enable"
          auth_concurrent_value: "0"
          authtimeout: "0"
          company: "optional"
          email: "disable"
          expire: "14400"
          expire_type: "immediately"
          group_type: "firewall"
          guest:
              -
                  comment: "Comment."
                  company: "<your_own_value>"
                  email: "<your_own_value>"
                  expiration: "<your_own_value>"
                  id: "16"
                  mobile_phone: "<your_own_value>"
                  name: "default_name_18"
                  password: "<your_own_value>"
                  sponsor: "<your_own_value>"
                  user_id: "<your_own_value>"
          http_digest_realm: "<your_own_value>"
          id: "23"
          match:
              -
                  group_name: "<your_own_value>"
                  id: "26"
                  server_name: "<your_own_value> (source user.radius.name user.ldap.name user.tacacs+.name user.saml.name user.external-identity-provider
                    .name)"
          max_accounts: "0"
          member:
              -
                  name: "default_name_30 (source user.peer.name user.local.name user.radius.name user.tacacs+.name user.ldap.name user.saml.name user
                    .external-identity-provider.name user.adgrp.name user.pop3.name user.certificate.name)"
          mobile_phone: "disable"
          multiple_guest_add: "disable"
          name: "default_name_33"
          password: "auto-generate"
          sms_custom_server: "<your_own_value> (source system.sms-server.name)"
          sms_server: "fortiguard"
          sponsor: "optional"
          sso_attribute_value: "<your_own_value>"
          user_id: "email"
          user_name: "disable"

Return Values

Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:

build - Build number of the fortigate image returned: always type: str sample: 1547
http_method - Last method used to provision the content into FortiGate returned: always type: str sample: PUT
http_status - Last result given by FortiGate on last operation applied returned: always type: str sample: 200
mkey - Master key (id) used in the last call to FortiGate returned: success type: str sample: id
name - Name of the table used to fulfill the request returned: always type: str sample: urlfilter
path - Path of the table used to fulfill the request returned: always type: str sample: webfilter
revision - Internal revision number returned: always type: str sample: 17.0.2.10658
serial - Serial number of the unit returned: always type: str sample: FGVMEVYYQT3AB5352
status - Indication of the operation's result returned: always type: str sample: success
vdom - Virtual domain used returned: always type: str sample: root
version - Version of the FortiGate returned: always type: str sample: v5.6.3

Status

This module is not guaranteed to have a backwards compatible interface.

Authors

Link Zheng (@chillancezen)
Jie Xue (@JieX19)
Hongbin Lu (@fgtdev-hblu)
Frank Shen (@frankshen01)
Miguel Angel Munoz (@mamunozgonzalez)
Nicolas Thomas (@thomnico)

Hint

If you notice any issues in this documentation, you can create a pull request to improve it.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fortios_user_group.rst

fortios_user_group.rst

fortios_user_group -- Configure user groups in Fortinet's FortiOS and FortiGate.

Synopsis

Requirements

Tips

FortiOS Version Compatibility

Parameters

Notes

Examples

Return Values

Status

Authors

	Supported Version Ranges
auth_concurrent_override	`v6.0.0 -> 7.4.3`
[enable]	`v6.0.0 -> 7.4.3`
[disable]	`v6.0.0 -> 7.4.3`

	Supported Version Ranges
auth_concurrent_value	`v6.0.0 -> 7.4.3`

	Supported Version Ranges
company	`v6.0.0 -> 7.4.3`
[optional]	`v6.0.0 -> 7.4.3`
[mandatory]	`v6.0.0 -> 7.4.3`
[disabled]	`v6.0.0 -> 7.4.3`

	Supported Version Ranges
email	`v6.0.0 -> 7.4.3`
[disable]	`v6.0.0 -> 7.4.3`
[enable]	`v6.0.0 -> 7.4.3`

	Supported Version Ranges
expire_type	`v6.0.0 -> 7.4.3`
[immediately]	`v6.0.0 -> 7.4.3`
[first-successful-login]	`v6.0.0 -> 7.4.3`

	Supported Version Ranges
group_type	`v6.0.0 -> 7.4.3`
[firewall]	`v6.0.0 -> 7.4.3`
[fsso-service]	`v6.0.0 -> 7.4.3`
[rsso]	`v6.0.0 -> 7.4.3`
[guest]	`v6.0.0 -> 7.4.3`

	Supported Version Ranges
id	`v6.0.0 -> v7.0.5`	`v7.2.0 -> v7.2.0`

	Supported Version Ranges
mobile_phone	`v6.0.0 -> 7.4.3`
[disable]	`v6.0.0 -> 7.4.3`
[enable]	`v6.0.0 -> 7.4.3`

	Supported Version Ranges
multiple_guest_add	`v6.0.0 -> 7.4.3`
[disable]	`v6.0.0 -> 7.4.3`
[enable]	`v6.0.0 -> 7.4.3`

	Supported Version Ranges
password	`v6.0.0 -> 7.4.3`
[auto-generate]	`v6.0.0 -> 7.4.3`
[specify]	`v6.0.0 -> 7.4.3`
[disable]	`v6.0.0 -> 7.4.3`

	Supported Version Ranges
sms_server	`v6.0.0 -> 7.4.3`
[fortiguard]	`v6.0.0 -> 7.4.3`
[custom]	`v6.0.0 -> 7.4.3`

	Supported Version Ranges
sponsor	`v6.0.0 -> 7.4.3`
[optional]	`v6.0.0 -> 7.4.3`
[mandatory]	`v6.0.0 -> 7.4.3`
[disabled]	`v6.0.0 -> 7.4.3`

	Supported Version Ranges
sso_attribute_value	`v6.0.0 -> 7.4.3`

	Supported Version Ranges
user_id	`v6.0.0 -> 7.4.3`
[email]	`v6.0.0 -> 7.4.3`
[auto-generate]	`v6.0.0 -> 7.4.3`
[specify]	`v6.0.0 -> 7.4.3`

	Supported Version Ranges
user_name	`v6.0.0 -> 7.4.3`
[disable]	`v6.0.0 -> 7.4.3`
[enable]	`v6.0.0 -> 7.4.3`

Files

fortios_user_group.rst

Latest commit

History

fortios_user_group.rst

File metadata and controls

fortios_user_group -- Configure user groups in Fortinet's FortiOS and FortiGate.