Internal User

Location in GUI: Administration » Identity Management » Identities » Users

Diagram

Classes

identity_management (ise)

Name	Type	Constraint	Mandatory	Default Value
internal_users	List	[internal_users]	No

internal_users (ise.identity_management)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[\w\d_\-\. @]+$	Yes
description	String		No
enabled	Boolean	true, false	No	true
email	String		No
account_name_alias	String		No
password	String		No
password_version	Integer	min: 1	No
enable_password	String		No
enable_password_version	Integer	min: 1	No
first_name	String		No
last_name	String		No
change_password	Boolean	true, false	No	true
user_identity_groups	List	String	No
password_never_expires	Boolean	true, false	No
password_id_store	String		No	Internal Users
custom_attributes	Map		No

Examples

ise:
  identity_management:
    internal_users:
      - name: ap-user
        enabled: true
        password: Cisco123
        first_name: AP User
        change_password: false
        user_identity_groups:
          - EAP-USERS
        password_id_store: Internal Users

Write-only secrets example:

Opt a secret into Terraform’s write-only handling so it is never persisted to Terraform state (requires the ISE provider 0.5.0+ and Terraform 1.11+). Declaring a <secret>_version key next to a secret opts that secret in; a secret without a _version key keeps using the existing state-storing attribute unchanged. Because the write-only value itself is invisible to Terraform’s plan, the _version integer is the only signal it has that the secret changed — bump it to any higher value whenever the secret value changes, in the same apply.

Internal users support this for password and enable_password.

ise:
  identity_management:
    internal_users:
      - name: secure-user
        enabled: true
        password: Cisco123
        password_version: 1 # bump alongside `password` to rotate it; the value itself is never written to state
        enable_password: Cisco123
        enable_password_version: 1
        password_id_store: Internal Users

Location in GUI: Administration » Identity Management » Identities » Users

Diagram

Classes

identity_management (ise)

Name	Type	Constraint	Mandatory	Default Value
internal_users	List	[internal_users]	No

internal_users (ise.identity_management)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[\w\d_\-\. ]+$	Yes
description	String		No
enabled	Boolean	true, false	No	true
email	String		No
account_name_alias	String		No
password	String		No
enable_password	String		No
first_name	String		No
last_name	String		No
change_password	Boolean	true, false	No	true
user_identity_groups	List	String	No
password_never_expires	Boolean	true, false	No
password_id_store	String		No	Internal Users
custom_attributes	Map		No

Examples

ise:
  identity_management:
    internal_users:
      - name: ap-user
        enabled: true
        password: Cisco123
        first_name: AP User
        change_password: false
        user_identity_groups:
          - EAP-USERS
        password_id_store: Internal Users

Location in GUI: Administration » Identity Management » Identities » Users

Diagram

Classes

identity_management (ise)

Name	Type	Constraint	Mandatory	Default Value
internal_users	List	[internal_users]	No

internal_users (ise.identity_management)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[\w\d_\-\.]+$	Yes
description	String		No
enabled	Boolean	true, false	No	true
email	String		No
account_name_alias	String		No
password	String		Yes
enable_password	String		No
first_name	String		No
last_name	String		No
change_password	Boolean	true, false	No	true
user_identity_groups	List	String	No
password_never_expires	Boolean	true, false	No
password_id_store	String		No	Internal Users

Examples

ise:
  identity_management:
    internal_users:
      - name: ap-user
        enabled: true
        password: Cisco123
        first_name: AP User
        change_password: false
        user_identity_groups:
          - EAP-USERS
        password_id_store: Internal Users