dellemc.enterprise_sonic.sonic_aaa module – Manage AAA configuration on SONiC

Note

This module is part of the dellemc.enterprise_sonic collection (version 3.2.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install dellemc.enterprise_sonic.

To use it in a playbook, specify: dellemc.enterprise_sonic.sonic_aaa.

New in dellemc.enterprise_sonic 1.1.0

Synopsis
Parameters
Notes
Examples
Return Values

Synopsis

This module provides configuration management of AAA for devices running SONiC.

Parameters

Parameter	Comments
config dictionary	AAA configuration For all lists in the module, the list items should be specified in order of desired priority. List items specified first have the highest priority.
authentication dictionary added in dellemc.enterprise_sonic 3.0.0	AAA authentication configuration
auth_method list / elements=string	Specifies the order of the methods in which to authenticate login Any 1 choice may be specified or 2 choices consisting of local and another group may be specified `cac-piv` option is only available in devices running sonic 4.5.0 and above. MFA is not applicable when `cac-piv` is configured as first factor for authentication. Choices: `"ldap"` `"local"` `"radius"` `"tacacs+"` `"cac-piv"`
console_auth_local boolean	Enable/disable local authentication on console Choices: `false` `true`
failthrough boolean	Enable/disable failthrough Choices: `false` `true`
login_mfa_console boolean added in dellemc.enterprise_sonic 3.1.0	Enable/disable MFA method for console access. Choices: `false` `true`
mfa_auth_method string added in dellemc.enterprise_sonic 3.1.0	Specifies RSA SecurID as multi-factor authentication method. Choices: `"rsa-securid"`
authorization dictionary added in dellemc.enterprise_sonic 3.0.0	AAA authorization configuration
commands_auth_method list / elements=string	Specifies the order of the methods in which to authorize commands Choices: `"local"` `"tacacs+"`
login_auth_method list / elements=string	Specifies the order of the methods in which to authorize login Choices: `"ldap"` `"local"`
name_service dictionary added in dellemc.enterprise_sonic 3.0.0	AAA name-service configuration
group list / elements=string	Name-service source for group method Choices: `"ldap"` `"local"` `"login"`
netgroup list / elements=string	Name-service source for netgroup method Choices: `"ldap"` `"local"`
passwd list / elements=string	Name-service source for passwd method Choices: `"ldap"` `"local"` `"login"`
shadow list / elements=string	Name-service source for shadow method Choices: `"ldap"` `"local"` `"login"`
sudoers list / elements=string	Name-service source for sudoers method Choices: `"ldap"` `"local"`
state string	The state of the configuration after module completion Choices: `"merged"` ← (default) `"deleted"` `"overridden"` `"replaced"`

Notes

Note

Tested against Enterprise SONiC Distribution by Dell Technologies
Supports check_mode

Examples

# Using "merged" state
#
# Before state:
# -------------
#
# sonic# show aaa
# (No AAA configuration present)
#
# sonic# show mfa
# ---------------------------------------------------------
# Multi-factor Authentication Information
# ---------------------------------------------------------
# MFA Authentication             : None
# Console Exempted               : None
# MFA Service Security Profile   : None
# RSA SecurID Security Profile   : None

- name: Merge AAA configuration
  dellemc.enterprise_sonic.sonic_aaa:
    config:
      authentication:
        auth_method:
          - local
          - ldap
        console_auth_local: true
        failthrough: true
        mfa_auth_method: 'rsa-securid'
        login_mfa_console: true
      authorization:
        commands_auth_method:
          - local
          - tacacs+
        login_auth_method:
          - local
          - ldap
      name_service:
        group:
          - ldap
        netgroup:
          - local
        passwd:
          - login
        shadow:
          - ldap
        sudoers:
          - local
    state: merged

# After state:
# ------------
#
# sonic# show aaa
# ---------------------------------------------------------
# AAA Authentication Information
# ---------------------------------------------------------
# failthrough  : True
# login-method : local, ldap
# login-mfa    : rsa-securid
# console authentication  : local
# ---------------------------------------------------------
# AAA Authorization Information
# ---------------------------------------------------------
# login        : local, ldap
# commands     : local, tacacs+
# ---------------------------------------------------------
# AAA Name-Service Information
# ---------------------------------------------------------
# group-method    : ldap
# netgroup-method : local
# passwd-method   : login
# shadow-method   : ldap
# sudoers-method  : local
#
# sonic# show mfa
# ---------------------------------------------------------
# Multi-factor Authentication Information
# ---------------------------------------------------------
# MFA Authentication             : rsa-securid
# Console Exempted               : No
# MFA Service Security Profile   : None
# RSA SecurID Security Profile   : None


# Using "replaced" state
#
# Before state:
# -------------
#
# sonic# show aaa
# ---------------------------------------------------------
# AAA Authentication Information
# ---------------------------------------------------------
# failthrough  : True
# login-method : local, ldap
# login-mfa    : rsa-securid
# console authentication  : local
# ---------------------------------------------------------
# AAA Authorization Information
# ---------------------------------------------------------
# login        : local, ldap
# commands     : local, tacacs+
# ---------------------------------------------------------
# AAA Name-Service Information
# ---------------------------------------------------------
# group-method    : ldap
# netgroup-method : local
# passwd-method   : login
# shadow-method   : ldap
# sudoers-method  : local
#
# sonic# show mfa
# ---------------------------------------------------------
# Multi-factor Authentication Information
# ---------------------------------------------------------
# MFA Authentication             : rsa-securid
# Console Exempted               : No
# MFA Service Security Profile   : None
# RSA SecurID Security Profile   : None

- name: Replace AAA configuration
  dellemc.enterprise_sonic.sonic_aaa:
    config:
      authentication:
        auth_method:
          - cac-piv
          - local
        console_auth_local: true
        failthrough: false
      authorization:
        commands_auth_method:
          - local
      name_service:
        group:
          - ldap
    state: replaced

# After state:
# ------------
#
# sonic# show aaa
# ---------------------------------------------------------
# AAA Authentication Information
# ---------------------------------------------------------
# failthrough  : False
# login-method : cac-piv, local
# login-mfa    : None
# console authentication  : local
# ---------------------------------------------------------
# AAA Authorization Information
# ---------------------------------------------------------
# login        : local
# ---------------------------------------------------------
# AAA Name-Service Information
# ---------------------------------------------------------
# group-method    : ldap
#
# sonic# show mfa
# ---------------------------------------------------------
# Multi-factor Authentication Information
# ---------------------------------------------------------
# MFA Authentication             : None
# Console Exempted               : None
# MFA Service Security Profile   : None
# RSA SecurID Security Profile   : None


# Using "overridden" state
#
# Before state:
# -------------
#
# sonic# show aaa
# ---------------------------------------------------------
# AAA Authentication Information
# ---------------------------------------------------------
# failthrough  : True
# login-method : local, ldap
# login-mfa    : rsa-securid
# console authentication  : local
# ---------------------------------------------------------
# AAA Authorization Information
# ---------------------------------------------------------
# login        : local, ldap
# commands     : local, tacacs+
# ---------------------------------------------------------
# AAA Name-Service Information
# ---------------------------------------------------------
# group-method    : ldap
# netgroup-method : local
# passwd-method   : login
# shadow-method   : ldap
# sudoers-method  : local
#
# sonic# show mfa
# ---------------------------------------------------------
# Multi-factor Authentication Information
# ---------------------------------------------------------
# MFA Authentication             : rsa-securid
# Console Exempted               : Yes
# MFA Service Security Profile   : None
# RSA SecurID Security Profile   : None

- name: Override AAA configuration
  dellemc.enterprise_sonic.sonic_aaa:
    config:
      authentication:
        auth_method:
          - tacacs+
        console_auth_local: true
        failthrough: true
        mfa_auth_method: 'rsa-securid'
        login_mfa_console: true
    state: overridden

# After state:
# ------------
#
# sonic# show aaa
# ---------------------------------------------------------
# AAA Authentication Information
# ---------------------------------------------------------
# failthrough  : True
# login-method : tacacs+
# login-mfa    : rsa-securid
# console authentication  : local
#
# sonic# show mfa
# ---------------------------------------------------------
# Multi-factor Authentication Information
# ---------------------------------------------------------
# MFA Authentication             : rsa-securid
# Console Exempted               : No
# MFA Service Security Profile   : None
# RSA SecurID Security Profile   : None


# Using "deleted" state
#
# Before state:
# -------------
#
# sonic# show aaa
# ---------------------------------------------------------
# AAA Authentication Information
# ---------------------------------------------------------
# failthrough  : True
# login-method : local, ldap
# login-mfa    : rsa-securid
# console authentication  : local
# ---------------------------------------------------------
# AAA Authorization Information
# ---------------------------------------------------------
# login        : local, ldap
# commands     : local, tacacs+
# ---------------------------------------------------------
# AAA Name-Service Information
# ---------------------------------------------------------
# group-method    : ldap
# netgroup-method : local
# passwd-method   : login
# shadow-method   : ldap
# sudoers-method  : local
#
# sonic# show mfa
# ---------------------------------------------------------
# Multi-factor Authentication Information
# ---------------------------------------------------------
# MFA Authentication             : rsa-securid
# Console Exempted               : No
# MFA Service Security Profile   : None
# RSA SecurID Security Profile   : None

- name: Delete AAA individual attributes
  dellemc.enterprise_sonic.sonic_aaa:
    config:
      authentication:
        auth_method:
          - local
          - ldap
        console_auth_local: true
        failthrough: true
        mfa_auth_method: 'rsa-securid'
        login_mfa_console: true
      authorization:
        commands_auth_method:
          - local
          - tacacs+
        login_auth_method:
          - local
          - ldap
      name_service:
        group:
          - ldap
        netgroup:
          - local
        passwd:
          - login
        shadow:
          - ldap
        sudoers:
          - local
    state: deleted

# After state:
# ------------
#
# sonic# show aaa
# (No AAA configuration present)
#
# sonic# show mfa
# ---------------------------------------------------------
# Multi-factor Authentication Information
# ---------------------------------------------------------
# MFA Authentication             : None
# Console Exempted               : None
# MFA Service Security Profile   : None
# RSA SecurID Security Profile   : None


# Using "deleted" state
#
# Before state:
# -------------
#
# sonic# show aaa
# ---------------------------------------------------------
# AAA Authentication Information
# ---------------------------------------------------------
# failthrough  : True
# login-method : local, ldap
# login-mfa    : rsa-securid
# console authentication  : local
# ---------------------------------------------------------
# AAA Authorization Information
# ---------------------------------------------------------
# login        : local, ldap
# commands     : local, tacacs+
# ---------------------------------------------------------
# AAA Name-Service Information
# ---------------------------------------------------------
# group-method    : ldap
# netgroup-method : local
# passwd-method   : login
# shadow-method   : ldap
# sudoers-method  : local
#
# sonic# show mfa
# ---------------------------------------------------------
# Multi-factor Authentication Information
# ---------------------------------------------------------
# MFA Authentication             : rsa-securid
# Console Exempted               : Yes
# MFA Service Security Profile   : None
# RSA SecurID Security Profile   : None

- name: Delete all AAA configuration
  dellemc.enterprise_sonic.sonic_aaa:
    config: {}
    state: deleted

# After state:
# ------------
#
# sonic# show aaa
# (No AAA configuration present)
#
# sonic# show mfa
# ---------------------------------------------------------
# Multi-factor Authentication Information
# ---------------------------------------------------------
# MFA Authentication             : None
# Console Exempted               : None
# MFA Service Security Profile   : None
# RSA SecurID Security Profile   : None

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Description
after dictionary	The resulting configuration module invocation. Returned: when changed
after(generated) dictionary	The generated configuration module invocation. Returned: when `check_mode`
before dictionary	The configuration prior to the module invocation. Returned: always
commands list / elements=string	The set of commands pushed to the remote device. Returned: always Sample: `["command 1", "command 2", "command 3"]`

Authors

1. Talabi (@stalabi1)

Collection links

© 2012–2018 Michael DeHaan
© 2018–2025 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/projects/ansible/latest/collections/dellemc/enterprise_sonic/sonic_aaa_module.html