External Authentication

Data Structures

ExternalAuthenticationModel

Attribute	Type	Required	Description
id	string	yes	Read-only object identifier
name	string	yes	Unique; case insensitive
type	string {cerb, radius, ldap, ad, tacacs}	yes	Immutable
address	string	If type == cerb || ldap || radius || tacacs & port is set	Authentication server address. Required for selected types if port is set.
port	number	If type == cerb || ldap || radius || tacacs & address is set	Server port. Must be used with address. Value format: port.
bind_ip	string		Bind address. Include labels like ‘fudo:label:test’ or ip address
login	string	If type == ad & secret is set	Login for AD authentication. Must be used with secret.
cerb	ExternalAuthentication-CerbModel	If type == cerb	Cerb object definiton
radius	ExternalAuthentication-RadiusModel	If type == radius	Radius object definiton
ldap	ExternalAuthentication-LdapModel	If type == ldap	LDAP object definiton
ad	ExternalAuthentication-AdModel	If type == ad	Active Directory object definiton
tacacs	ExternalAuthentication-TacacsModel	If type == tacacs	TACACS+ object definition
tls_enabled	boolean	If type == ad || ldap	Enable TLS protocol. Can also be set for type == tacacs.
tls_certificate	string	If type == ldap || tacacs & tls_enabled == true	Client TLS certificate. Format: X.509.
tls_ca_certificate	string	If type == ad || ldap || tacacs & tls_enabled == true	CA certificate for TLS validation. Format: X.509.
second_factor_type	string {duo, oath, sms}
created_at	datetime		Read-only
modified_at	datetime		Read-only
removed	boolean		Read-only

ExternalAuthenticationCerbModel

Attribute	Type	Description
secret	string	Password to cerb provider; required; write-only
radius_nasid	string	Correct value of NAS id of Cerb provider; required

ExternalAuthenticationRadiusModel

Attribute	Type	Description
secret	string	Password to radius provider; required; write-only
radius_nasid	string	Correct value of NAS id of Radius provider; required
radius_method	string {chap, mschap, pap}	Authentication method for RADIUS. Values: chap (CHAP), mschap (MS-CHAPv2), pap (PAP). Default: mschap
radius_message_authenticator	boolean	Use Message-Authenticator to mitigate BlastRADIUS vulnerability. Default: true
radius_append_domain	boolean	Append the user’s AD domain to the username sent to the RADIUS server, in the {name}@{ad_domain} format. When false, the bare username is sent. Default: true

ExternalAuthenticationLdapModel

Attribute	Type	Description
ldap_binddn	string	Bind domain to LDAP provider; required

ExternalAuthenticationAdModel

Attribute	Type	Description
login	string	Login for AD authentication. Used with secret.
secret	string	Password to AD provider; write-only. Used with login.
ad_domain	string	Bind domain to AD provider; required

ExternalAuthenticationTacacsModel

Attribute	Type	Description
secret	string	Shared key of the TACACS+ server; write-only. Required when tls_enabled == false, optional over TLS.
tacacs_method	string {ascii, chap, pap}	Authentication method for TACACS+. Values: ascii (ASCII), chap (CHAP), pap (PAP). Default: ascii
tacacs_append_domain	boolean	Append the user’s AD domain to the username sent to the TACACS+ server, in the {name}@{ad_domain} format. When false, the bare username is sent. Default: true
tls_client_certificate	string	Certificate that Fudo Enterprise presents to the TACACS+ server (mutual TLS). Format: X.509. Requires tls_enabled == true; must be used with tls_client_key.
tls_client_key	string	Private key of the client certificate; protected, write-only. Must be used with tls_client_certificate.
tls_client_key_passphrase	string	Passphrase to decrypt tls_client_key; protected, write-only.

Retrieve Available Attributes of the ExternalAuthentication- Model

Request

Method	GET
Path	/api/v2/objspec/external_authentication

To check allowed methods, available URL parameters and possible responses please refer to the API Overview section.

Refer to the Batch operations topic to create nested requests for operating on the External Authentication objects.

Get External Authentication Methods List

Request

Method	GET
Path	/api/v2/external_authentication

Example Request

GET /api/v2/external_authentication

Response

{
        "result": "success",
        "external_authentication": [
            {
                "id": "1234538875067072557",
                "type": "ad",
                "port": 636,
                "ad_domain": "jdoe.local",
                "created_at": "2021-08-09 19:40:05.171853+02",
                "modified_at": "2021-08-09 19:40:05.171853+02",
                "address": "10.0.139.100",
                "tls_enabled": true,
                "tls_certificate": "-----BEGIN CERTIFICATE-----\r\nMIIFrTCCBJWgAwIBAg...ic=\r\n-----END CERTIFICATE-----\r\n"
            },
            {
                "id": "12345138875067072517",
                "type": "ldap",
                "port": 389,
                "ldap_binddn": "dc=qa-ldap,dc=null",
                "created_at": "2021-03-03 14:11:52.245683+01",
                "modified_at": "2021-03-03 14:14:46.052855+01",
                "address": "10.0.235.1",
                "tls_enabled": false,
                "tls_certificate": ""
            },
            {
                "id": "12345067072573",
                "type": "cerb",
                "port": 1812,
                "created_at": "2022-10-19 10:23:11.29545+02",
                "modified_at": "2022-10-19 10:58:12.325396+02",
                "address": "10.0.234.21",
                "radius_nasid": "",
                "tls_enabled": false,
                "tls_certificate": ""
            },
            {
                "id": "3234566775067072572",
                "type": "radius",
                "port": 1812,
                "created_at": "2022-10-19 10:08:23.160433+02",
                "modified_at": "2022-10-19 10:19:50.525671+02",
                "second_factor_type": "oath",
                "address": "10.0.0.1",
                "radius_nasid": "abcdeg",
                "tls_enabled": true,
                "tls_certificate": "-----BEGIN CERTIFICATE-----\r\nMIIG5jC...2MOXV1x+eQAm0Vy\r\n-----END CERTIFICATE-----\r\n"
                }
        ]
}

Get External Authentication Method by ID

Request

Method	GET
Path	/api/v2/external_authentication/<id>

Example Request

GET /api/v2/external_authentication/<id>

Response

{
        "result": "success",
        "external_authentication": [
                {
                        "id": "1234538875067072557",
                        "type": "ad",
                        "port": 636,
                        "ad_domain": "jdoe.local",
                        "created_at": "2021-08-09 19:40:05.171853+02",
                        "modified_at": "2021-08-09 19:40:05.171853+02",
                        "address": "10.0.139.100",
                        "tls_enabled": true,
                        "tls_certificate": "-----BEGIN CERTIFICATE-----\r\nMIIFrTCCBJWgAwIBAg...ic=\r\n-----END CERTIFICATE-----\r\n"
                }
        ]
}

Modify External Authentication Method

Request

Method	PATCH
Path	/api/v2/external_authentication/<id>
Headers	Content-Type: Application/JSON
Body	ExternalAuthenticationModel

Example Request: Adding SMS Authentication for Second Factor to AD Authentication

PATCH /api/v2/external_authentication/<id>

{
        "second_factor_type": "sms"
}

Response

{
        "result": "success"
}

Create an External Authentication Method

Request

Method	POST
Path	/api/v2/external_authentication
Headers	Content-Type: Application/JSON
Body	ExternalAuthenticationModel

Example Request: Creating Cerb Definition With Second Factor OATH Authentication

POST /api/v2/external_authentication

{
        "type": "cerb",
        "port": 1812,
        "address": "10.0.234.21",
        "radius_nasid": "abcds",
        "secret": "my-password",
        "tls_enabled": false,
        "second_factor_type": "oath"
}

Response

{
        "result": "success",
        "external_authentication": {
                "id": "123456819172646913"
        }
}

Example Request: Creating TACACS+ Definition

curl -s -k -X POST \
  -H 'Authorization: <token>' \
  -H 'Content-Type: application/json' \
  'https://10.33.4.37/api/v2/external_authentication' \
  -d '{
    "name": "TACACS+ primary",
    "type": "tacacs",
    "address": "10.0.234.30",
    "port": 49,
    "secret": "my-tacacs-key",
    "tacacs_method": "pap",
    "tacacs_append_domain": false,
    "tls_enabled": false
  }'

Response

{
    "result": "success",
    "external_authentication": {
        "id": "5512405943901487109"
    }
}

Delete an External Authentication Method

Request

Method	DELETE
Path	/api/v2/external_authentication/<id>