Skip to content

Define 'mfa' model for the Dell Enterprise SONiC collection #293

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 7 commits into
base: master
Choose a base branch
from
Open

Define 'mfa' model for the Dell Enterprise SONiC collection #293

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
8b2d720
Define 'mfa' model for the Dell Enterprise SONiC collection
Jan 8, 2025
8aa2b08
Changes to mfa model
Jan 19, 2025
fad38e8
Added encrypt values
Jan 27, 2025
03ec713
Addressing review comments
Jan 29, 2025
1d8834f
removed overriden example
Jan 29, 2025
5fb13f9
Example for overriden
Jan 29, 2025
6eab8cb
Addressing review comments
Jan 31, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
79 changes: 79 additions & 0 deletions models/enterprise_sonic/mfa/deleted_example_01.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,79 @@
# Using deleted
#
# Before state:
# -------------
#
# sonic# show running-configuration mfa
# mfa key-seed U2FsdGVkX1/caD7u0ZGRnb981G2DKyML/Gvyfexsurg= encrypted
# mfa client-secret U2FsdGVkX1+WlquxtZRbsgQhfS1lQBFbJKflxGAp6S3u+Ox5Hi+O16NmprjMVb3HQn1pNSgaaa0Cz1MHeTfDWhFR0WqdENbLU2PqkiRDHv0iVfl72xNPzhnGeO01kAu0 encrypted
# mfa security-profile mSecurityProfile
# mfa rsa-server security-profile rSecProfile
# mfa rsa-server host rsaserver.che-lab.it client-id sonicdevtest.che-lab.it client-key U2FsdGVkX18QFJoB9dp8GJN92eP79FGOZDLgQakBmAasGYX77p6PtiiAfS/nGoOb2uEocUkryc+BLLYsg+Wz0gO+c1QsIbIhXk5Pt+aECoVgoFQ9QpxO9od9cTik+3Ot encrypted
#
# sonic# show mfa
# ---------------------------------------------------------
# Multi-factor Authentication Information
# ---------------------------------------------------------
# MFA Authentication : None
# Console Exempted : None
# MFA Service Security Profile : mSecurityProfile
# RSA SecurID Security Profile : rSecProfile
#
# sonic# show mfa rsa-servers
# ------------------------------------------------------------------------------------------------------------
# HOST PORT CONNECTION_TIMEOUT READ_TIMEOUT CLIENT_ID
# ------------------------------------------------------------------------------------------------------------
# rsaserver.che-lab.it 5555 20 120 sonicdevtest.che-lab.it
#
# sonic# show running-configuration | grep "cac-piv"
# aaa cac-piv cert-user common-name
# aaa cac-piv cert-user-match 10digit-username
# aaa cac-piv security-profile cSecurityProfile
# sonic#


- name: Delete specified mfa configuration
dellemc.enterprise_sonic.sonic_mfa:
config:
mfa_global:
key_seed: 'U2FsdGVkX1/caD7u0ZGRnb981G2DKyML/Gvyfexsurg='
key_seed_encrypted: true
client_secret: 'U2FsdGVkX1+WlquxtZRbsgQhfS1lQBFbJKflxGAp6S3u+Ox5Hi+O16NmprjMVb3HQn1pNSgaaa0Cz1MHeTfDWhFR0WqdENbLU2PqkiRDHv0iVfl72xNPzhnGeO01kAu0'
client_secret_encrypted: true
rsa_global:
rsa_security_profile: 'rSecProfile'
rsa_servers:
hostname: 'rsaserver.che-lab.it'
server_port: 5555
client_id: 'sonicdevtest.che-lab.it'
client_key: 'U2FsdGVkX18QFJoB9dp8GJN92eP79FGOZDLgQakBmAasGYX77p6PtiiAfS/nGoOb2uEocUkryc+BLLYsg+Wz0gO+c1QsIbIhXk5Pt+aECoVgoFQ9QpxO9od9cTik+3Ot'
client_key_encrypted: true
connection_timeout: 20
read_timeout: 120
cac_piv_global:
cacpiv_security_profile: 'cSecurityProfile'
cert_username_field: 'common-name'
state: deleted


# After state:
# ------------
#
# sonic# show running-configuration mfa
# mfa security-profile mSecurityProfile
#
# sonic# show mfa
# ---------------------------------------------------------
# Multi-factor Authentication Information
# ---------------------------------------------------------
# MFA Authentication : None
# Console Exempted : None
# MFA Service Security Profile : mSecurityProfile
# RSA SecurID Security Profile : None
#
# sonic# show mfa rsa-servers
# sonic#
#
# sonic# show running-configuration | grep "cac-piv"
# aaa cac-piv cert-user-match 10digit-username
# sonic#
60 changes: 60 additions & 0 deletions models/enterprise_sonic/mfa/deleted_example_02.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,60 @@
# Using deleted
#
# Before state:
# -------------
#
# sonic# show running-configuration mfa
# mfa key-seed U2FsdGVkX1/caD7u0ZGRnb981G2DKyML/Gvyfexsurg= encrypted
# mfa client-secret U2FsdGVkX1+WlquxtZRbsgQhfS1lQBFbJKflxGAp6S3u+Ox5Hi+O16NmprjMVb3HQn1pNSgaaa0Cz1MHeTfDWhFR0WqdENbLU2PqkiRDHv0iVfl72xNPzhnGeO01kAu0 encrypted
# mfa security-profile mSecurityProfile
# mfa rsa-server security-profile rSecProfile
# mfa rsa-server host rsaserver.che-lab.it client-id sonicdevtest.che-lab.it client-key U2FsdGVkX18QFJoB9dp8GJN92eP79FGOZDLgQakBmAasGYX77p6PtiiAfS/nGoOb2uEocUkryc+BLLYsg+Wz0gO+c1QsIbIhXk5Pt+aECoVgoFQ9QpxO9od9cTik+3Ot encrypted
#
# sonic# show mfa
# ---------------------------------------------------------
# Multi-factor Authentication Information
# ---------------------------------------------------------
# MFA Authentication : None
# Console Exempted : None
# MFA Service Security Profile : mSecurityProfile
# RSA SecurID Security Profile : rSecProfile
#
# sonic# show mfa rsa-servers
# ------------------------------------------------------------------------------------------------------------
# HOST PORT CONNECTION_TIMEOUT READ_TIMEOUT CLIENT_ID
# ------------------------------------------------------------------------------------------------------------
# rsaserver.che-lab.it 5555 20 120 sonicdevtest.che-lab.it
#
# sonic# show running-configuration | grep "cac-piv"
# aaa cac-piv cert-user common-name
# aaa cac-piv cert-user-match 10digit-username
# aaa cac-piv security-profile cSecurityProfile
# sonic#


- name: Delete all mfa configurations
dellemc.enterprise_sonic.sonic_mfa:
config:
state: deleted


# After state:
# ------------
#
# sonic# show running-configuration mfa
# sonic#
#
# sonic# show mfa
# ---------------------------------------------------------
# Multi-factor Authentication Information
# ---------------------------------------------------------
# MFA Authentication : None
# Console Exempted : None
# MFA Service Security Profile : None
# RSA SecurID Security Profile : None
#
# sonic# show mfa rsa-servers
# sonic#
#
# sonic# show running-configuration | grep "cac-piv"
# sonic#
78 changes: 78 additions & 0 deletions models/enterprise_sonic/mfa/merged_example_01.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,78 @@
# Using merged
#
# Before State:
# -------------
#
# sonic# show running-configuration mfa
# sonic#
#
# sonic# show mfa
# ---------------------------------------------------------
# Multi-factor Authentication Information
# ---------------------------------------------------------
# MFA Authentication : None
# Console Exempted : None
# MFA Service Security Profile : None
# RSA SecurID Security Profile : None
#
# sonic# show mfa rsa-servers
# sonic#
#
# sonic# show running-configuration | grep "cac-piv"
# sonic#

- name: Merge provided MFA configurations
dellemc.enterprise_sonic.sonic_mfa:
config:
mfa_global:
mfa_security_profile: 'mSecurityProfile'
key_seed: 'sonic'
key_seed_encrypted: true
client_secret: 'U2FsdGVkX18mPdwkM1z24i7lxMtqNZR9p2q3aa6YXR16OfDxQXCR9z9I0lQZpVjE!'
client_secret_encrypted: true
rsa_global:
rsa_security_profile: 'rSecProfile'
rsa_servers:
hostname: 'rsaserver.che-lab.it'
server_port: 5555
client_id: 'sonicdevtest.che-lab.it'
client_key: 'aplr05825jshusp80699scuv62u5l3lu63wxf66b0y883w92677ac0c9m0lwv6o8'
client_key_encrypted: true
connection_timeout: 20
read_timeout: 120
cac_piv_global:
cacpiv_security_profile: 'cSecurityProfile'
cert_username_field: 'user-principal-name'
cert_username_match: '10digit-username'
state: merged

# After State:
# ------------
#
# sonic# show running-configuration mfa
# mfa key-seed U2FsdGVkX1/caD7u0ZGRnb981G2DKyML/Gvyfexsurg= encrypted
# mfa client-secret U2FsdGVkX1+WlquxtZRbsgQhfS1lQBFbJKflxGAp6S3u+Ox5Hi+O16NmprjMVb3HQn1pNSgaaa0Cz1MHeTfDWhFR0WqdENbLU2PqkiRDHv0iVfl72xNPzhnGeO01kAu0 encrypted
# mfa security-profile mSecurityProfile
# mfa rsa-server security-profile rSecProfile
# mfa rsa-server host rsaserver.che-lab.it client-id sonicdevtest.che-lab.it client-key U2FsdGVkX18QFJoB9dp8GJN92eP79FGOZDLgQakBmAasGYX77p6PtiiAfS/nGoOb2uEocUkryc+BLLYsg+Wz0gO+c1QsIbIhXk5Pt+aECoVgoFQ9QpxO9od9cTik+3Ot encrypted
#
# sonic# show mfa
# ---------------------------------------------------------
# Multi-factor Authentication Information
# ---------------------------------------------------------
# MFA Authentication : None
# Console Exempted : None
# MFA Service Security Profile : mSecurityProfile
# RSA SecurID Security Profile : rSecProfile
#
# sonic# show mfa rsa-servers
# ------------------------------------------------------------------------------------------------------------
# HOST PORT CONNECTION_TIMEOUT READ_TIMEOUT CLIENT_ID
# ------------------------------------------------------------------------------------------------------------
# rsaserver.che-lab.it 5555 20 120 sonicdevtest.che-lab.it
#
# sonic# show running-configuration | grep "cac-piv"
# aaa cac-piv cert-user user-principal-name
# aaa cac-piv cert-user-match 10digit-username
# aaa cac-piv security-profile cSecurityProfile
# sonic#
37 changes: 37 additions & 0 deletions models/enterprise_sonic/mfa/overridden_example_01.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
# Using overridden
#
# Before state:
# -------------
#
# sonic# show mfa rsa-servers
# ------------------------------------------------------------------------------------------------------------
# HOST PORT CONNECTION_TIMEOUT READ_TIMEOUT CLIENT_ID
# ------------------------------------------------------------------------------------------------------------
# rsaserver.che-lab.it 5555 20 120 sonicdevtest.che-lab.it
# sonicrsaserver.che-lab.it 5555 29 125 sonic.che-lab.it
#


- name: Override device configuration of mfa rsa-servers with provided configuration
dellemc.enterprise_sonic.sonic_mfa:
config:
rsa_servers:
- hostname: 'rsaserver.che-lab.it'
server_port: 5555
client_id: 'sonicdevtest.che-lab.it'
client_key: 'aplr05825jshusp80699scuv62u5l3lu63wxf66b0y883w92677ac0c9m0lwv6o8'
client_key_encrypted: true
connection_timeout: 29
read_timeout: 149
state: overriden
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
state: overriden
state: overridden



# After state:
# ------------
#
# sonic# show mfa rsa-servers
# ------------------------------------------------------------------------------------------------------------
# HOST PORT CONNECTION_TIMEOUT READ_TIMEOUT CLIENT_ID
# ------------------------------------------------------------------------------------------------------------
# rsaserver.che-lab.it 5555 29 149 sonicdevtest.che-lab.it

38 changes: 38 additions & 0 deletions models/enterprise_sonic/mfa/replaced_example_01.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
# Using replaced
#
# Before state:
# -------------
#
# sonic# show mfa rsa-servers
# ------------------------------------------------------------------------------------------------------------
# HOST PORT CONNECTION_TIMEOUT READ_TIMEOUT CLIENT_ID
# ------------------------------------------------------------------------------------------------------------
# rsaserver.che-lab.it 5555 20 120 sonicdevtest.che-lab.it
# sonicrsaserver.che-lab.it 5555 29 125 sonic.che-lab.it
#


- name: Replace specified mfa rsa-server configuration
dellemc.enterprise_sonic.sonic_mfa:
config:
rsa_servers:
- hostname: 'rsaserver.che-lab.it'
server_port: 5555
client_id: 'sonicdevtest.che-lab.it'
client_key: 'aplr05825jshusp80699scuv62u5l3lu63wxf66b0y883w92677ac0c9m0lwv6o8'
client_key_encrypted: true
connection_timeout: 29
read_timeout: 149
state: replaced


# After state:
# ------------
#
# sonic# show mfa rsa-servers
# ------------------------------------------------------------------------------------------------------------
# HOST PORT CONNECTION_TIMEOUT READ_TIMEOUT CLIENT_ID
# ------------------------------------------------------------------------------------------------------------
# rsaserver.che-lab.it 5555 29 149 sonicdevtest.che-lab.it
# sonicrsaserver.che-lab.it 5555 29 125 sonic.che-lab.it

Loading