topic TACACS Profile - API for common task type in Network Access Control

TACACS Profile - API for common task type

lanagna — Thu, 14 Mar 2024 16:55:13 GMT

Hi Team,

Looking for Ansible API for the particular "Common Task type" to set as Nexus and by default it will choose Shell using API

cisco.ise.tacacs_profile, but couldn't able to find the API for the Nexus setup as per the below snip.

Please help me with the exact API or reference link

Re: TACACS Profile - API for common task type

Greg Gibbs — Thu, 14 Mar 2024 22:28:31 GMT

There is no such for those 'Common Task Types'. You would need to select the Raw View tab and build your API calls based on that data.

Example:
{
"TacacsProfile": {
"id": "e09c3a20-e250-11ee-a3a8-1296ee463e27",
"name": "Nexus_RO",
"description": "",
"sessionAttributes": {
"sessionAttributeList": [
{
"type": "OPTIONAL",
"name": "shell:roles",
"value": "\"network-operator\""
}
]
},
"link": {
"rel": "self",
"href": "https://ise32-3.ise.trappedunderise.com:9060/ers/config/tacacsprofile/e09c3a20-e250-11ee-a3a8-1296ee463e27",
"type": "application/json"
}
}
}

Re: TACACS Profile - API for common task type

thomas — Thu, 14 Mar 2024 23:01:38 GMT

The easiest way to do this is to configure it in the GUI like you have done then perform a GET on the respective API object (tacacsprofile) to see what the REST object looks like:

curl --include --insecure --location \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --user $ISE_REST_USERNAME:$ISE_REST_PASSWORD \ --request GET https://$ISE_HOSTNAME/ers/config/tacacsprofile/name/ReadOnly { "TacacsProfile" : { "id" : "a8696100-e255-11ee-a872-5600453c2db2", "name" : "ReadOnly", "description" : "", "sessionAttributes" : { "sessionAttributeList" : [ { "type" : "OPTIONAL", "name" : "shell:roles", "value" : "\"network-operator\"" } ] }, "link" : { "rel" : "self", "href" : "https://198.18.133.27/ers/config/tacacsprofile/name/ReadOnly", "type" : "application/json" } } }

You can then use that data to figure out what values to use in the respective cisco.ise.tacacs_profile module:

- name: Create TACACS Profile `ReadOnly` cisco.ise.tacacs_profile: ise_hostname: "{{ise_hostname}}" ise_username: "{{ise_username}}" ise_password: "{{ise_password}}" ise_verify: "{{ise_verify}}" state: present description: string name: ReadOnly sessionAttributes: sessionAttributeList: - name: "shell:roles" type: OPTIONAL value: "\"network-operator\""

Re: TACACS Profile - API for common task type

lanagna — Wed, 20 Mar 2024 19:49:50 GMT

Thanks @thomas @Greg Gibbs for the inputs. Let me check on the same.