Internal User

Location in GUI: Administration » Identity Management » Identities » Users

Diagram

Classes

ise

Name	Type	Constraint	Mandatory	Default Value
identity_management	Class	identity_management	No

identity_management (ise)

Name	Type	Constraint	Mandatory	Default Value
internal_users	List	internal_users	No

internal_users (ise.identity_management)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: `^[\w\d_\-\. @]+$`	Yes
description	String		No
enabled	Boolean	`true`, `false`	No	`true`
email	String		No
account_name_alias	String		No
password	String		No
password_version	Integer	min: `1`	No
enable_password	String		No
enable_password_version	Integer	min: `1`	No
first_name	String		No
last_name	String		No
change_password	Boolean	`true`, `false`	No	`true`
user_identity_groups	List	String	No
password_never_expires	Boolean	`true`, `false`	No
password_id_store	String		No	`Internal Users`
custom_attributes	Map		No

internal_users (ise.identity_management)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: `^[\w\d_\-\. ]+$`	Yes
description	String		No
enabled	Boolean	`true`, `false`	No	`true`
email	String		No
account_name_alias	String		No
password	String		No
enable_password	String		No
first_name	String		No
last_name	String		No
change_password	Boolean	`true`, `false`	No	`true`
user_identity_groups	List	String	No
password_never_expires	Boolean	`true`, `false`	No
password_id_store	String		No	`Internal Users`
custom_attributes	Map		No

internal_users (ise.identity_management)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: `^[\w\d_\-\.]+$`	Yes
description	String		No
enabled	Boolean	`true`, `false`	No	`true`
email	String		No
account_name_alias	String		No
password	String		Yes
enable_password	String		No
first_name	String		No
last_name	String		No
change_password	Boolean	`true`, `false`	No	`true`
user_identity_groups	List	String	No
password_never_expires	Boolean	`true`, `false`	No
password_id_store	String		No	`Internal Users`

Examples

ise:
  identity_management:
    internal_users:
      - name: ap-user
        enabled: true
        password: Cisco123
        first_name: AP User
        change_password: false
        user_identity_groups:
          - EAP-USERS
        password_id_store: Internal Users

Write-only secrets example:

Opt a secret into Terraform’s write-only handling so it is never persisted to Terraform state (requires the ISE provider 0.5.0+ and Terraform 1.11+). Declaring a <secret>_version key next to a secret opts that secret in; a secret without a _version key keeps using the existing state-storing attribute unchanged. Because the write-only value itself is invisible to Terraform’s plan, the _version integer is the only signal it has that the secret changed — bump it to any higher value whenever the secret value changes, in the same apply.

Internal users support this for password and enable_password.

ise:
  identity_management:
    internal_users:
      - name: secure-user
        enabled: true
        password: Cisco123
        password_version: 1 # bump alongside `password` to rotate it; the value itself is never written to state
        enable_password: Cisco123
        enable_password_version: 1
        password_id_store: Internal Users

Examples

ise:
  identity_management:
    internal_users:
      - name: ap-user
        enabled: true
        password: Cisco123
        first_name: AP User
        change_password: false
        user_identity_groups:
          - EAP-USERS
        password_id_store: Internal Users