Closed KubaMazurkiewicz closed 11 months ago
fmunozmiranda
commented
1 year ago @KubaMazurkiewicz, The parameter was included in the new version, you could help us to communicate with cisco, this in order for this parameter to be included in the documentation, since it does not appear.
Please try again with the new version.
kuba-mazurkiewicz
commented
1 year ago @fmunozmiranda looks like there is an issue in ERS API for 3.1 ISE version. (CSCwd34564 ISE 3.1: Cannot create Allowed Protocols with TEAP using ERS API due to 'RequestBasicPwdAuth' error)
Even though you added this parameter in new terraform provider version state handling doesn't work as expected, becauseterraform is refreshing state of object using GET request and in GET response this requestBasicPwdAuth parameter under teap is not existing:
~~~ RESPONSE ~~~
STATUS : 200
PROTO : HTTP/1.1
RECEIVED AT : 2023-07-28T12:10:37.666838+02:00
TIME DURATION: 272.423167ms
HEADERS :
Cache-Control: no-cache, no-store, must-revalidate
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;
Content-Type: application/json;charset=utf-8
Date: Fri, 28 Jul 2023 09:57:34 GMT
Etag: "106F59067EFDE573965D40CA00C9C832"
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server:
Set-Cookie: JSESSIONIDSSO=DA17D2A15FB498564B4A4E28A3E6E409; Path=/; Secure; HttpOnly, APPSESSIONID=F4E31CDF75BA92BBFFF7B6F94D58627F; Path=/ers; Secure; HttpOnly
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Webkit-Csp: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;
X-Xss-Protection: 1; mode=block
BODY :
{
"AllowedProtocols": {
"id": "0f9ec0d0-2d2b-11ee-bf2c-ca44e3c393f8",
"name": "Test22",
"description": "string",
"eapTls": {
"allowEapTlsAuthOfExpiredCerts": false,
"eapTlsEnableStatelessSessionResume": false
},
"teap": {
"allowTeapEapMsChapV2": true,
"allowTeapEapMsChapV2PwdChange": false,
"allowTeapEapMsChapV2PwdChangeRetries": 1,
"allowTeapEapTls": true,
"allowTeapEapTlsAuthOfExpiredCerts": true,
"acceptClientCertDuringTunnelEst": false,
"enableEapChaining": true,
"allowDowngradeMsk": true
},
"processHostLookup": false,
"allowPapAscii": false,
"allowChap": false,
"allowMsChapV1": false,
"allowMsChapV2": false,
"allowEapMd5": false,
"allowLeap": false,
"allowEapTls": true,
"allowEapTtls": false,
"allowEapFast": false,
"allowPeap": false,
"allowTeap": true,
"allowPreferredEapProtocol": false,
"eapTlsLBit": false,
"allowWeakCiphersForEap": false,
"requireMessageAuth": false,
"link": {
"rel": "self",
"href": https://10.48.190.181:9060/ers/config/allowedprotocols/0f9ec0d0-2d2b-11ee-bf2c-ca44e3c393f8,
"type": "application/json"
}
}
}So everytime i do terraform plan it will show that there would be change in this parameter:
✗ terraform plan
ciscoise_allowed_protocols.example: Refreshing state... [id=id:=c96b93f0-37ab-11ee-bf2c-ca44e3c393f8\name:=Test02]
Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
~ update in-place
Terraform will perform the following actions:
# ciscoise_allowed_protocols.example will be updated in-place
~ resource "ciscoise_allowed_protocols" "example" {
id = "id:=c96b93f0-37ab-11ee-bf2c-ca44e3c393f8\\name:=Test02"
# (2 unchanged attributes hidden)
~ parameters {
id = "c96b93f0-37ab-11ee-bf2c-ca44e3c393f8"
name = "Test02"
# (18 unchanged attributes hidden)
~ teap {
+ request_basic_pwd_auth = "false"
# (8 unchanged attributes hidden)
}
# (1 unchanged block hidden)
}
}
Plan: 0 to add, 1 to change, 0 to destroy.I have no idea what this RequestBasicPwdAuth parameter is, cause I cannot configure this parameter via GUI.
When I was digging more into API it turns out that this issue CSCwd34564 was fixed in 3.2 version of ISE, and in teap there is no need to use this parameter. Of course allowed_protocols in TF doesn’t work with 3.2 cause there is some new mandatory parameter in ERS API called FiveG which is not in TF provider schema.
Which brings the same topic as in issue 98 that there should be terraform provider release for 3.2 ISE version specially now since 3.2 was marked by Cisco as suggested release, and there are substantial changes in API.
KubaMazurkiewicz
commented
11 months ago Since in 3.2 request_basic_pwd_auth was removed im closing this issue.
Prerequisites
Describe the bug Following TF code is not working:
I'm getting error:
Looks like this parameter is mandatory, cause when I try following code (without this parameter) im getting this error:
code:
error:
Expected behavior In ERS API I can create allowed_protocols with requestBasicPwdAuth
POST: https://10.48.190.181/ers/config/allowedprotocols
Body:
Result: 201 Created
Environment (please complete the following information):
Additional context Add any other context about the problem here.