Class: MistApi::OrgSettingMistNac

Inherits:
BaseModel
  • Object
show all
Defined in:
lib/mist_api/models/org_setting_mist_nac.rb

Overview

OrgSettingMistNac Model.

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Methods inherited from BaseModel

#check_for_conflict, #process_additional_properties, #process_array, #process_basic_value, #process_hash, #to_hash, #to_json

Constructor Details

#initialize(allow_teap_machine_auth_only = false, cacerts = SKIP, default_idp_id = SKIP, disable_rsae_algorithms = false, eap_ssl_security_level = 2, eu_only = false, fingerprinting = SKIP, idp_machine_cert_lookup_field = IdpMachineCertLookupFieldEnum::AUTOMATIC, idp_user_cert_lookup_field = IdpUserCertLookupFieldEnum::AUTOMATIC, idps = SKIP, mdm = SKIP, server_cert = SKIP, use_ip_version = OrgSettingMistNacIpVersionEnum::V4, use_ssl_port = false, usermac_expiry = 0) ⇒ OrgSettingMistNac

Returns a new instance of OrgSettingMistNac.



142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
 
# File 'lib/mist_api/models/org_setting_mist_nac.rb', line 142

def initialize(
  allow_teap_machine_auth_only = false, cacerts = SKIP,
  default_idp_id = SKIP, disable_rsae_algorithms = false,
  eap_ssl_security_level = 2, eu_only = false, fingerprinting = SKIP,
  idp_machine_cert_lookup_field = IdpMachineCertLookupFieldEnum::AUTOMATIC,
  idp_user_cert_lookup_field = IdpUserCertLookupFieldEnum::AUTOMATIC,
  idps = SKIP, mdm = SKIP, server_cert = SKIP,
  use_ip_version = OrgSettingMistNacIpVersionEnum::V4, use_ssl_port = false,
  usermac_expiry = 0
)
  unless allow_teap_machine_auth_only == SKIP
    @allow_teap_machine_auth_only =
      allow_teap_machine_auth_only
  end
  @cacerts = cacerts unless cacerts == SKIP
  @default_idp_id = default_idp_id unless default_idp_id == SKIP
  @disable_rsae_algorithms = disable_rsae_algorithms unless disable_rsae_algorithms == SKIP
  @eap_ssl_security_level = eap_ssl_security_level unless eap_ssl_security_level == SKIP
  @eu_only = eu_only unless eu_only == SKIP
  @fingerprinting = fingerprinting unless fingerprinting == SKIP
  unless idp_machine_cert_lookup_field == SKIP
    @idp_machine_cert_lookup_field =
      idp_machine_cert_lookup_field
  end
  unless idp_user_cert_lookup_field == SKIP
    @idp_user_cert_lookup_field =
      idp_user_cert_lookup_field
  end
  @idps = idps unless idps == SKIP
  @mdm = mdm unless mdm == SKIP
  @server_cert = server_cert unless server_cert == SKIP
  @use_ip_version = use_ip_version unless use_ip_version == SKIP
  @use_ssl_port = use_ssl_port unless use_ssl_port == SKIP
  @usermac_expiry = usermac_expiry unless usermac_expiry == SKIP
end

Instance Attribute Details

#allow_teap_machine_auth_only ⇒ TrueClass | FalseClass

allow clients to connect even when the user cert failed. TEAP authenticates both Machine Cert and User Cert. When enabled, clients who only succeed Machine Cert authentication will be accepted.

Returns:

  • (TrueClass | FalseClass) 


16
17
18
 
# File 'lib/mist_api/models/org_setting_mist_nac.rb', line 16

def allow_teap_machine_auth_only
  @allow_teap_machine_auth_only
end

#cacerts ⇒ Array[String]

List of PEM-encoded ca certs

Returns:

  • (Array[String]) 


20
21
22
 
# File 'lib/mist_api/models/org_setting_mist_nac.rb', line 20

def cacerts
  @cacerts
end

#default_idp_id ⇒ String

use this IDP when no explicit realm present in the incoming username/CN OR when no IDP is explicitly mapped to the incoming realm.

Returns:

  • (String) 


25
26
27
 
# File 'lib/mist_api/models/org_setting_mist_nac.rb', line 25

def default_idp_id
  @default_idp_id
end

#disable_rsae_algorithms ⇒ TrueClass | FalseClass

to disable RSAE_PSS_SHA256, RSAE_PSS_SHA384, RSAE_PSS_SHA512 from server side. see www.openssl.org/docs/man3.0/man1/openssl-ciphers.html

Returns:

  • (TrueClass | FalseClass) 


30
31
32
 
# File 'lib/mist_api/models/org_setting_mist_nac.rb', line 30

def disable_rsae_algorithms
  @disable_rsae_algorithms
end

#eap_ssl_security_level ⇒ Integer

eap ssl security level, see www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_security_level.html #DEFAULT-CALLBACK-BEHAVIOUR

Returns:

  • (Integer) 


36
37
38
 
# File 'lib/mist_api/models/org_setting_mist_nac.rb', line 36

def eap_ssl_security_level
  @eap_ssl_security_level
end

#eu_only ⇒ TrueClass | FalseClass

By default, NAC POD failover considers all NAC pods available around the globe, i.e. EU, US, or APAC based, failover happens based on geo IP of the originating site. For strict GDPR compliance NAC POD failover would only happen between the PODs located within the EU environment, and no authentication would take place outside of EU. This is an org setting that is applicable to WLANs, switch templates, mxedge clusters that have mist_nac enabled

Returns:

  • (TrueClass | FalseClass) 


46
47
48
 
# File 'lib/mist_api/models/org_setting_mist_nac.rb', line 46

def eu_only
  @eu_only
end

#fingerprinting ⇒ OrgSettingMistNacFingerprinting

Allows customer to enable client fingerprinting for policy enforcement

Returns:



50
51
52
 
# File 'lib/mist_api/models/org_setting_mist_nac.rb', line 50

def fingerprinting
  @fingerprinting
end

#idp_machine_cert_lookup_field ⇒ IdpMachineCertLookupFieldEnum

allow customer to choose the EAP-TLS client certificate’s field to use for IDP Machine Groups lookup. enum: ‘automatic`, `cn`, `dns`

Returns:



55
56
57
 
# File 'lib/mist_api/models/org_setting_mist_nac.rb', line 55

def idp_machine_cert_lookup_field
  @idp_machine_cert_lookup_field
end

#idp_user_cert_lookup_field ⇒ IdpUserCertLookupFieldEnum

allow customer to choose the EAP-TLS client certificate’s field. To use for IDP User Groups lookup. enum: ‘automatic`, `cn`, `email`, `upn`

Returns:



60
61
62
 
# File 'lib/mist_api/models/org_setting_mist_nac.rb', line 60

def idp_user_cert_lookup_field
  @idp_user_cert_lookup_field
end

#idps ⇒ Array[OrgSettingMistNacIdp]

allow customer to choose the EAP-TLS client certificate’s field. To use for IDP User Groups lookup. enum: ‘automatic`, `cn`, `email`, `upn`

Returns:



65
66
67
 
# File 'lib/mist_api/models/org_setting_mist_nac.rb', line 65

def idps
  @idps
end

#mdm ⇒ OrgSettingMistNacMdm

MDM (Mobile Device Management) CoA configuration

Returns:



69
70
71
 
# File 'lib/mist_api/models/org_setting_mist_nac.rb', line 69

def mdm
  @mdm
end

#server_cert ⇒ OrgSettingMistNacServerCert

radius server cert to be presented in EAP TLS

Returns:



73
74
75
 
# File 'lib/mist_api/models/org_setting_mist_nac.rb', line 73

def server_cert
  @server_cert
end

#use_ip_version ⇒ OrgSettingMistNacIpVersionEnum

by default, NAS devices(switches/aps) and proxies(mxedge) are configured to reach mist-nac via IPv4. enum: ‘v4`, `v6`

Returns:



78
79
80
 
# File 'lib/mist_api/models/org_setting_mist_nac.rb', line 78

def use_ip_version
  @use_ip_version
end

#use_ssl_port ⇒ TrueClass | FalseClass

By default, NAS devices (switches/aps) and proxies(mxedge) are configured to use port TCP2083(RadSec) to reach mist-nac. Set ‘use_ssl_port`==`true` to override that port with TCP43 (ssl), This is an org level setting that is applicable to wlans, switch_templates, and mxedge_clusters that have mist-nac enabled

Returns:

  • (TrueClass | FalseClass) 


86
87
88
 
# File 'lib/mist_api/models/org_setting_mist_nac.rb', line 86

def use_ssl_port
  @use_ssl_port
end

#usermac_expiry ⇒ Integer

Allow customer to configure an expiry time for usermacs by attaching a Quarantine label to those which have been inactive for the configured period of time (in days). 0 means no expiry

Returns:

  • (Integer) 


92
93
94
 
# File 'lib/mist_api/models/org_setting_mist_nac.rb', line 92

def usermac_expiry
  @usermac_expiry
end

Class Method Details

.from_hash(hash) ⇒ Object

Creates an instance of the object from a hash.



179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
 
# File 'lib/mist_api/models/org_setting_mist_nac.rb', line 179

def self.from_hash(hash)
  return nil unless hash

  # Extract variables from the hash.
  allow_teap_machine_auth_only =
    hash['allow_teap_machine_auth_only'] ||= false
  cacerts = hash.key?('cacerts') ? hash['cacerts'] : SKIP
  default_idp_id =
    hash.key?('default_idp_id') ? hash['default_idp_id'] : SKIP
  disable_rsae_algorithms = hash['disable_rsae_algorithms'] ||= false
  eap_ssl_security_level = hash['eap_ssl_security_level'] ||= 2
  eu_only = hash['eu_only'] ||= false
  fingerprinting = OrgSettingMistNacFingerprinting.from_hash(hash['fingerprinting']) if
    hash['fingerprinting']
  idp_machine_cert_lookup_field =
    hash['idp_machine_cert_lookup_field'] ||= IdpMachineCertLookupFieldEnum::AUTOMATIC
  idp_user_cert_lookup_field =
    hash['idp_user_cert_lookup_field'] ||= IdpUserCertLookupFieldEnum::AUTOMATIC
  # Parameter is an array, so we need to iterate through it
  idps = nil
  unless hash['idps'].nil?
    idps = []
    hash['idps'].each do |structure|
      idps << (OrgSettingMistNacIdp.from_hash(structure) if structure)
    end
  end

  idps = SKIP unless hash.key?('idps')
  mdm = OrgSettingMistNacMdm.from_hash(hash['mdm']) if hash['mdm']
  server_cert = OrgSettingMistNacServerCert.from_hash(hash['server_cert']) if
    hash['server_cert']
  use_ip_version =
    hash['use_ip_version'] ||= OrgSettingMistNacIpVersionEnum::V4
  use_ssl_port = hash['use_ssl_port'] ||= false
  usermac_expiry = hash['usermac_expiry'] ||= 0

  # Create object from extracted values.
  OrgSettingMistNac.new(allow_teap_machine_auth_only,
                        cacerts,
                        default_idp_id,
                        disable_rsae_algorithms,
                        eap_ssl_security_level,
                        eu_only,
                        fingerprinting,
                        idp_machine_cert_lookup_field,
                        idp_user_cert_lookup_field,
                        idps,
                        mdm,
                        server_cert,
                        use_ip_version,
                        use_ssl_port,
                        usermac_expiry)
end

.names ⇒ Object

A mapping from model property names to API property names.



95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
 
# File 'lib/mist_api/models/org_setting_mist_nac.rb', line 95

def self.names
  @_hash = {} if @_hash.nil?
  @_hash['allow_teap_machine_auth_only'] = 'allow_teap_machine_auth_only'
  @_hash['cacerts'] = 'cacerts'
  @_hash['default_idp_id'] = 'default_idp_id'
  @_hash['disable_rsae_algorithms'] = 'disable_rsae_algorithms'
  @_hash['eap_ssl_security_level'] = 'eap_ssl_security_level'
  @_hash['eu_only'] = 'eu_only'
  @_hash['fingerprinting'] = 'fingerprinting'
  @_hash['idp_machine_cert_lookup_field'] =
    'idp_machine_cert_lookup_field'
  @_hash['idp_user_cert_lookup_field'] = 'idp_user_cert_lookup_field'
  @_hash['idps'] = 'idps'
  @_hash['mdm'] = 'mdm'
  @_hash['server_cert'] = 'server_cert'
  @_hash['use_ip_version'] = 'use_ip_version'
  @_hash['use_ssl_port'] = 'use_ssl_port'
  @_hash['usermac_expiry'] = 'usermac_expiry'
  @_hash
end

.nullables ⇒ Object

An array for nullable fields



138
139
140
 
# File 'lib/mist_api/models/org_setting_mist_nac.rb', line 138

def self.nullables
  []
end

.optionals ⇒ Object

An array for optional fields



117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
 
# File 'lib/mist_api/models/org_setting_mist_nac.rb', line 117

def self.optionals
  %w[
    allow_teap_machine_auth_only
    cacerts
    default_idp_id
    disable_rsae_algorithms
    eap_ssl_security_level
    eu_only
    fingerprinting
    idp_machine_cert_lookup_field
    idp_user_cert_lookup_field
    idps
    mdm
    server_cert
    use_ip_version
    use_ssl_port
    usermac_expiry
  ]
end

Instance Method Details

#inspect ⇒ Object

Provides a debugging-friendly string with detailed object information.



247
248
249
250
251
252
253
254
255
256
257
258
 
# File 'lib/mist_api/models/org_setting_mist_nac.rb', line 247

def inspect
  class_name = self.class.name.split('::').last
  "<#{class_name} allow_teap_machine_auth_only: #{@allow_teap_machine_auth_only.inspect},"\
  " cacerts: #{@cacerts.inspect}, default_idp_id: #{@default_idp_id.inspect},"\
  " disable_rsae_algorithms: #{@disable_rsae_algorithms.inspect}, eap_ssl_security_level:"\
  " #{@eap_ssl_security_level.inspect}, eu_only: #{@eu_only.inspect}, fingerprinting:"\
  " #{@fingerprinting.inspect}, idp_machine_cert_lookup_field:"\
  " #{@idp_machine_cert_lookup_field.inspect}, idp_user_cert_lookup_field:"\
  " #{@idp_user_cert_lookup_field.inspect}, idps: #{@idps.inspect}, mdm: #{@mdm.inspect},"\
  " server_cert: #{@server_cert.inspect}, use_ip_version: #{@use_ip_version.inspect},"\
  " use_ssl_port: #{@use_ssl_port.inspect}, usermac_expiry: #{@usermac_expiry.inspect}>"
end

#to_s ⇒ Object

Provides a human-readable string representation of the object.



234
235
236
237
238
239
240
241
242
243
244
 
# File 'lib/mist_api/models/org_setting_mist_nac.rb', line 234

def to_s
  class_name = self.class.name.split('::').last
  "<#{class_name} allow_teap_machine_auth_only: #{@allow_teap_machine_auth_only}, cacerts:"\
  " #{@cacerts}, default_idp_id: #{@default_idp_id}, disable_rsae_algorithms:"\
  " #{@disable_rsae_algorithms}, eap_ssl_security_level: #{@eap_ssl_security_level}, eu_only:"\
  " #{@eu_only}, fingerprinting: #{@fingerprinting}, idp_machine_cert_lookup_field:"\
  " #{@idp_machine_cert_lookup_field}, idp_user_cert_lookup_field:"\
  " #{@idp_user_cert_lookup_field}, idps: #{@idps}, mdm: #{@mdm}, server_cert:"\
  " #{@server_cert}, use_ip_version: #{@use_ip_version}, use_ssl_port: #{@use_ssl_port},"\
  " usermac_expiry: #{@usermac_expiry}>"
end