Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Fortimanager Provider
  3. API Docs
  4. ObjectUserRadius
fortimanager 1.13.0 published on Thursday, Mar 13, 2025 by fortinetdev
fortinetdev/terraform-provider-fortimanager

fortimanager.ObjectUserRadius

Explore with Pulumi AI

fortimanager logo
fortimanager 1.13.0 published on Thursday, Mar 13, 2025 by fortinetdev
fortinetdev/terraform-provider-fortimanager

    Configure RADIUS server entries.

    The following variables have sub resource. Avoid using them together, otherwise conflicts and overwrites may occur.

    • accounting_server: fortimanager.ObjectUserRadiusAccountingserver
    • dynamic_mapping: fortimanager.ObjectUserRadiusDynamicMapping

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as fortimanager from "@pulumi/fortimanager";

const labelname = new fortimanager.ObjectUserRadius("labelname", {
    acctAllServers: "disable",
    acctInterimInterval: 0,
    allUsergroup: "disable",
    authType: "auto",
    classes: [],
    h3cCompatibility: "disable",
    interfaceSelectMethod: "auto",
    nasIp: "0.0.0.0",
    passwordEncoding: "auto",
    passwordRenewal: "enable",
    radiusCoa: "disable",
    radiusPort: 0,
    rsso: "disable",
    rssoContextTimeout: 0,
    rssoEpOneIpOnly: "disable",
    rssoLogFlags: [],
    rssoLogPeriod: 0,
    rssoRadiusServerPort: 0,
    rssoSecrets: [],
    secondarySecrets: ["tesssssss"],
    secrets: ["tesssssss"],
    server: "2.2.2.2",
    ssoAttributeValueOverride: "enable",
    switchControllerAcctFastFramedipDetect: 2,
    switchControllerServiceTypes: [],
    tertiarySecrets: ["tesssssss"],
    timeout: 5,
    useManagementVdom: "disable",
    usernameCaseSensitive: "disable",
});

    import pulumi
import pulumi_fortimanager as fortimanager

labelname = fortimanager.ObjectUserRadius("labelname",
    acct_all_servers="disable",
    acct_interim_interval=0,
    all_usergroup="disable",
    auth_type="auto",
    classes=[],
    h3c_compatibility="disable",
    interface_select_method="auto",
    nas_ip="0.0.0.0",
    password_encoding="auto",
    password_renewal="enable",
    radius_coa="disable",
    radius_port=0,
    rsso="disable",
    rsso_context_timeout=0,
    rsso_ep_one_ip_only="disable",
    rsso_log_flags=[],
    rsso_log_period=0,
    rsso_radius_server_port=0,
    rsso_secrets=[],
    secondary_secrets=["tesssssss"],
    secrets=["tesssssss"],
    server="2.2.2.2",
    sso_attribute_value_override="enable",
    switch_controller_acct_fast_framedip_detect=2,
    switch_controller_service_types=[],
    tertiary_secrets=["tesssssss"],
    timeout=5,
    use_management_vdom="disable",
    username_case_sensitive="disable")

    package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/fortimanager/fortimanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := fortimanager.NewObjectUserRadius(ctx, "labelname", &fortimanager.ObjectUserRadiusArgs{
			AcctAllServers:        pulumi.String("disable"),
			AcctInterimInterval:   pulumi.Float64(0),
			AllUsergroup:          pulumi.String("disable"),
			AuthType:              pulumi.String("auto"),
			Classes:               pulumi.StringArray{},
			H3cCompatibility:      pulumi.String("disable"),
			InterfaceSelectMethod: pulumi.String("auto"),
			NasIp:                 pulumi.String("0.0.0.0"),
			PasswordEncoding:      pulumi.String("auto"),
			PasswordRenewal:       pulumi.String("enable"),
			RadiusCoa:             pulumi.String("disable"),
			RadiusPort:            pulumi.Float64(0),
			Rsso:                  pulumi.String("disable"),
			RssoContextTimeout:    pulumi.Float64(0),
			RssoEpOneIpOnly:       pulumi.String("disable"),
			RssoLogFlags:          pulumi.StringArray{},
			RssoLogPeriod:         pulumi.Float64(0),
			RssoRadiusServerPort:  pulumi.Float64(0),
			RssoSecrets:           pulumi.StringArray{},
			SecondarySecrets: pulumi.StringArray{
				pulumi.String("tesssssss"),
			},
			Secrets: pulumi.StringArray{
				pulumi.String("tesssssss"),
			},
			Server:                                 pulumi.String("2.2.2.2"),
			SsoAttributeValueOverride:              pulumi.String("enable"),
			SwitchControllerAcctFastFramedipDetect: pulumi.Float64(2),
			SwitchControllerServiceTypes:           pulumi.StringArray{},
			TertiarySecrets: pulumi.StringArray{
				pulumi.String("tesssssss"),
			},
			Timeout:               pulumi.Float64(5),
			UseManagementVdom:     pulumi.String("disable"),
			UsernameCaseSensitive: pulumi.String("disable"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Fortimanager = Pulumi.Fortimanager;

return await Deployment.RunAsync(() => 
{
    var labelname = new Fortimanager.ObjectUserRadius("labelname", new()
    {
        AcctAllServers = "disable",
        AcctInterimInterval = 0,
        AllUsergroup = "disable",
        AuthType = "auto",
        Classes = new[] {},
        H3cCompatibility = "disable",
        InterfaceSelectMethod = "auto",
        NasIp = "0.0.0.0",
        PasswordEncoding = "auto",
        PasswordRenewal = "enable",
        RadiusCoa = "disable",
        RadiusPort = 0,
        Rsso = "disable",
        RssoContextTimeout = 0,
        RssoEpOneIpOnly = "disable",
        RssoLogFlags = new[] {},
        RssoLogPeriod = 0,
        RssoRadiusServerPort = 0,
        RssoSecrets = new[] {},
        SecondarySecrets = new[]
        {
            "tesssssss",
        },
        Secrets = new[]
        {
            "tesssssss",
        },
        Server = "2.2.2.2",
        SsoAttributeValueOverride = "enable",
        SwitchControllerAcctFastFramedipDetect = 2,
        SwitchControllerServiceTypes = new[] {},
        TertiarySecrets = new[]
        {
            "tesssssss",
        },
        Timeout = 5,
        UseManagementVdom = "disable",
        UsernameCaseSensitive = "disable",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.fortimanager.ObjectUserRadius;
import com.pulumi.fortimanager.ObjectUserRadiusArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var labelname = new ObjectUserRadius("labelname", ObjectUserRadiusArgs.builder()
            .acctAllServers("disable")
            .acctInterimInterval(0)
            .allUsergroup("disable")
            .authType("auto")
            .classes()
            .h3cCompatibility("disable")
            .interfaceSelectMethod("auto")
            .nasIp("0.0.0.0")
            .passwordEncoding("auto")
            .passwordRenewal("enable")
            .radiusCoa("disable")
            .radiusPort(0)
            .rsso("disable")
            .rssoContextTimeout(0)
            .rssoEpOneIpOnly("disable")
            .rssoLogFlags()
            .rssoLogPeriod(0)
            .rssoRadiusServerPort(0)
            .rssoSecrets()
            .secondarySecrets("tesssssss")
            .secrets("tesssssss")
            .server("2.2.2.2")
            .ssoAttributeValueOverride("enable")
            .switchControllerAcctFastFramedipDetect(2)
            .switchControllerServiceTypes()
            .tertiarySecrets("tesssssss")
            .timeout(5)
            .useManagementVdom("disable")
            .usernameCaseSensitive("disable")
            .build());

    }
}

    resources:
  labelname:
    type: fortimanager:ObjectUserRadius
    properties:
      acctAllServers: disable
      acctInterimInterval: 0
      allUsergroup: disable
      authType: auto
      classes: []
      h3cCompatibility: disable
      interfaceSelectMethod: auto
      nasIp: 0.0.0.0
      passwordEncoding: auto
      passwordRenewal: enable
      radiusCoa: disable
      radiusPort: 0
      rsso: disable
      rssoContextTimeout: 0
      rssoEpOneIpOnly: disable
      rssoLogFlags: []
      rssoLogPeriod: 0
      rssoRadiusServerPort: 0
      rssoSecrets: []
      secondarySecrets:
        - tesssssss
      secrets:
        - tesssssss
      server: 2.2.2.2
      ssoAttributeValueOverride: enable
      switchControllerAcctFastFramedipDetect: 2
      switchControllerServiceTypes: []
      tertiarySecrets:
        - tesssssss
      timeout: 5
      useManagementVdom: disable
      usernameCaseSensitive: disable

    Create ObjectUserRadius Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new ObjectUserRadius(name: string, args?: ObjectUserRadiusArgs, opts?: CustomResourceOptions);
    @overload
def ObjectUserRadius(resource_name: str,
                     args: Optional[ObjectUserRadiusArgs] = None,
                     opts: Optional[ResourceOptions] = None)

@overload
def ObjectUserRadius(resource_name: str,
                     opts: Optional[ResourceOptions] = None,
                     account_key_cert_field: Optional[str] = None,
                     account_key_processing: Optional[str] = None,
                     accounting_servers: Optional[Sequence[ObjectUserRadiusAccountingServerArgs]] = None,
                     acct_all_servers: Optional[str] = None,
                     acct_interim_interval: Optional[float] = None,
                     adom: Optional[str] = None,
                     all_usergroup: Optional[str] = None,
                     auth_type: Optional[str] = None,
                     ca_cert: Optional[str] = None,
                     call_station_id_type: Optional[str] = None,
                     classes: Optional[Sequence[str]] = None,
                     client_cert: Optional[str] = None,
                     delimiter: Optional[str] = None,
                     dynamic_mappings: Optional[Sequence[ObjectUserRadiusDynamicMappingArgs]] = None,
                     dynamic_sort_subtable: Optional[str] = None,
                     group_override_attr_type: Optional[str] = None,
                     h3c_compatibility: Optional[str] = None,
                     interface: Optional[str] = None,
                     interface_select_method: Optional[str] = None,
                     mac_case: Optional[str] = None,
                     mac_password_delimiter: Optional[str] = None,
                     mac_username_delimiter: Optional[str] = None,
                     name: Optional[str] = None,
                     nas_id: Optional[str] = None,
                     nas_id_type: Optional[str] = None,
                     nas_ip: Optional[str] = None,
                     object_user_radius_id: Optional[str] = None,
                     password_encoding: Optional[str] = None,
                     password_renewal: Optional[str] = None,
                     radius_coa: Optional[str] = None,
                     radius_port: Optional[float] = None,
                     rsso: Optional[str] = None,
                     rsso_context_timeout: Optional[float] = None,
                     rsso_endpoint_attribute: Optional[str] = None,
                     rsso_endpoint_block_attribute: Optional[str] = None,
                     rsso_ep_one_ip_only: Optional[str] = None,
                     rsso_flush_ip_session: Optional[str] = None,
                     rsso_log_flags: Optional[Sequence[str]] = None,
                     rsso_log_period: Optional[float] = None,
                     rsso_radius_response: Optional[str] = None,
                     rsso_radius_server_port: Optional[float] = None,
                     rsso_secrets: Optional[Sequence[str]] = None,
                     rsso_validate_request_secret: Optional[str] = None,
                     scopetype: Optional[str] = None,
                     secondary_secrets: Optional[Sequence[str]] = None,
                     secondary_server: Optional[str] = None,
                     secrets: Optional[Sequence[str]] = None,
                     server: Optional[str] = None,
                     server_identity_check: Optional[str] = None,
                     source_ip: Optional[str] = None,
                     source_ip_interfaces: Optional[Sequence[str]] = None,
                     sso_attribute: Optional[str] = None,
                     sso_attribute_key: Optional[str] = None,
                     sso_attribute_value_override: Optional[str] = None,
                     status_ttl: Optional[float] = None,
                     switch_controller_acct_fast_framedip_detect: Optional[float] = None,
                     switch_controller_nas_ip_dynamic: Optional[str] = None,
                     switch_controller_service_types: Optional[Sequence[str]] = None,
                     tertiary_secrets: Optional[Sequence[str]] = None,
                     tertiary_server: Optional[str] = None,
                     timeout: Optional[float] = None,
                     tls_min_proto_version: Optional[str] = None,
                     transport_protocol: Optional[str] = None,
                     use_management_vdom: Optional[str] = None,
                     username_case_sensitive: Optional[str] = None)
    func NewObjectUserRadius(ctx *Context, name string, args *ObjectUserRadiusArgs, opts ...ResourceOption) (*ObjectUserRadius, error)
    public ObjectUserRadius(string name, ObjectUserRadiusArgs? args = null, CustomResourceOptions? opts = null)
    public ObjectUserRadius(String name, ObjectUserRadiusArgs args)
public ObjectUserRadius(String name, ObjectUserRadiusArgs args, CustomResourceOptions options)

    type: fortimanager:ObjectUserRadius
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args ObjectUserRadiusArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args ObjectUserRadiusArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args ObjectUserRadiusArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args ObjectUserRadiusArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args ObjectUserRadiusArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var objectUserRadiusResource = new Fortimanager.ObjectUserRadius("objectUserRadiusResource", new()
{
    AccountKeyCertField = "string",
    AccountKeyProcessing = "string",
    AccountingServers = new[]
    {
        new Fortimanager.Inputs.ObjectUserRadiusAccountingServerArgs
        {
            Id = 0,
            Interface = "string",
            InterfaceSelectMethod = "string",
            Port = 0,
            Secrets = new[]
            {
                "string",
            },
            Server = "string",
            SourceIp = "string",
            Status = "string",
        },
    },
    AcctAllServers = "string",
    AcctInterimInterval = 0,
    Adom = "string",
    AllUsergroup = "string",
    AuthType = "string",
    CaCert = "string",
    CallStationIdType = "string",
    Classes = new[]
    {
        "string",
    },
    ClientCert = "string",
    Delimiter = "string",
    DynamicMappings = new[]
    {
        new Fortimanager.Inputs.ObjectUserRadiusDynamicMappingArgs
        {
            _scopes = new[]
            {
                new Fortimanager.Inputs.ObjectUserRadiusDynamicMapping_ScopeArgs
                {
                    Name = "string",
                    Vdom = "string",
                },
            },
            AccountKeyCertField = "string",
            AccountKeyProcessing = "string",
            AccountingServers = new[]
            {
                new Fortimanager.Inputs.ObjectUserRadiusDynamicMappingAccountingServerArgs
                {
                    Id = 0,
                    Interface = "string",
                    InterfaceSelectMethod = "string",
                    Port = 0,
                    Secrets = new[]
                    {
                        "string",
                    },
                    Server = "string",
                    SourceIp = "string",
                    Status = "string",
                },
            },
            AcctAllServers = "string",
            AcctInterimInterval = 0,
            AllUsergroup = "string",
            AuthType = "string",
            CaCert = "string",
            CallStationIdType = "string",
            Classes = new[]
            {
                "string",
            },
            ClientCert = "string",
            Delimiter = "string",
            DpCarrierEndpointAttribute = "string",
            DpCarrierEndpointBlockAttribute = "string",
            DpContextTimeout = 0,
            DpFlushIpSession = "string",
            DpHoldTime = 0,
            DpHttpHeader = "string",
            DpHttpHeaderFallback = "string",
            DpHttpHeaderStatus = "string",
            DpHttpHeaderSuppress = "string",
            DpLogDynFlags = new[]
            {
                "string",
            },
            DpLogPeriod = 0,
            DpMemPercent = 0,
            DpProfileAttribute = "string",
            DpProfileAttributeKey = "string",
            DpRadiusResponse = "string",
            DpRadiusServerPort = 0,
            DpSecrets = new[]
            {
                "string",
            },
            DpValidateRequestSecret = "string",
            DynamicProfile = "string",
            EndpointTranslation = "string",
            EpCarrierEndpointConvertHex = "string",
            EpCarrierEndpointHeader = "string",
            EpCarrierEndpointHeaderSuppress = "string",
            EpCarrierEndpointPrefix = "string",
            EpCarrierEndpointPrefixRangeMax = 0,
            EpCarrierEndpointPrefixRangeMin = 0,
            EpCarrierEndpointPrefixString = "string",
            EpCarrierEndpointSource = "string",
            EpIpHeader = "string",
            EpIpHeaderSuppress = "string",
            EpMissingHeaderFallback = "string",
            EpProfileQueryType = "string",
            GroupOverrideAttrType = "string",
            H3cCompatibility = "string",
            Interface = "string",
            InterfaceSelectMethod = "string",
            MacCase = "string",
            MacPasswordDelimiter = "string",
            MacUsernameDelimiter = "string",
            NasId = "string",
            NasIdType = "string",
            NasIp = "string",
            PasswordEncoding = "string",
            PasswordRenewal = "string",
            RadiusCoa = "string",
            RadiusPort = 0,
            Rsso = "string",
            RssoContextTimeout = 0,
            RssoEndpointAttribute = "string",
            RssoEndpointBlockAttribute = "string",
            RssoEpOneIpOnly = "string",
            RssoFlushIpSession = "string",
            RssoLogFlags = new[]
            {
                "string",
            },
            RssoLogPeriod = 0,
            RssoRadiusResponse = "string",
            RssoRadiusServerPort = 0,
            RssoSecrets = new[]
            {
                "string",
            },
            RssoValidateRequestSecret = "string",
            SecondarySecrets = new[]
            {
                "string",
            },
            SecondaryServer = "string",
            Secrets = new[]
            {
                "string",
            },
            Server = "string",
            ServerIdentityCheck = "string",
            SourceIp = "string",
            SourceIpInterfaces = new[]
            {
                "string",
            },
            SsoAttribute = "string",
            SsoAttributeKey = "string",
            SsoAttributeValueOverride = "string",
            StatusTtl = 0,
            SwitchControllerAcctFastFramedipDetect = 0,
            SwitchControllerNasIpDynamic = "string",
            SwitchControllerServiceTypes = new[]
            {
                "string",
            },
            TertiarySecrets = new[]
            {
                "string",
            },
            TertiaryServer = "string",
            Timeout = 0,
            TlsMinProtoVersion = "string",
            TransportProtocol = "string",
            UseGroupForProfile = "string",
            UseManagementVdom = "string",
            UsernameCaseSensitive = "string",
        },
    },
    DynamicSortSubtable = "string",
    GroupOverrideAttrType = "string",
    H3cCompatibility = "string",
    Interface = "string",
    InterfaceSelectMethod = "string",
    MacCase = "string",
    MacPasswordDelimiter = "string",
    MacUsernameDelimiter = "string",
    Name = "string",
    NasId = "string",
    NasIdType = "string",
    NasIp = "string",
    ObjectUserRadiusId = "string",
    PasswordEncoding = "string",
    PasswordRenewal = "string",
    RadiusCoa = "string",
    RadiusPort = 0,
    Rsso = "string",
    RssoContextTimeout = 0,
    RssoEndpointAttribute = "string",
    RssoEndpointBlockAttribute = "string",
    RssoEpOneIpOnly = "string",
    RssoFlushIpSession = "string",
    RssoLogFlags = new[]
    {
        "string",
    },
    RssoLogPeriod = 0,
    RssoRadiusResponse = "string",
    RssoRadiusServerPort = 0,
    RssoSecrets = new[]
    {
        "string",
    },
    RssoValidateRequestSecret = "string",
    Scopetype = "string",
    SecondarySecrets = new[]
    {
        "string",
    },
    SecondaryServer = "string",
    Secrets = new[]
    {
        "string",
    },
    Server = "string",
    ServerIdentityCheck = "string",
    SourceIp = "string",
    SourceIpInterfaces = new[]
    {
        "string",
    },
    SsoAttribute = "string",
    SsoAttributeKey = "string",
    SsoAttributeValueOverride = "string",
    StatusTtl = 0,
    SwitchControllerAcctFastFramedipDetect = 0,
    SwitchControllerNasIpDynamic = "string",
    SwitchControllerServiceTypes = new[]
    {
        "string",
    },
    TertiarySecrets = new[]
    {
        "string",
    },
    TertiaryServer = "string",
    Timeout = 0,
    TlsMinProtoVersion = "string",
    TransportProtocol = "string",
    UseManagementVdom = "string",
    UsernameCaseSensitive = "string",
});

    example, err := fortimanager.NewObjectUserRadius(ctx, "objectUserRadiusResource", &fortimanager.ObjectUserRadiusArgs{
AccountKeyCertField: pulumi.String("string"),
AccountKeyProcessing: pulumi.String("string"),
AccountingServers: .ObjectUserRadiusAccountingServerTypeArray{
&.ObjectUserRadiusAccountingServerTypeArgs{
Id: pulumi.Float64(0),
Interface: pulumi.String("string"),
InterfaceSelectMethod: pulumi.String("string"),
Port: pulumi.Float64(0),
Secrets: pulumi.StringArray{
pulumi.String("string"),
},
Server: pulumi.String("string"),
SourceIp: pulumi.String("string"),
Status: pulumi.String("string"),
},
},
AcctAllServers: pulumi.String("string"),
AcctInterimInterval: pulumi.Float64(0),
Adom: pulumi.String("string"),
AllUsergroup: pulumi.String("string"),
AuthType: pulumi.String("string"),
CaCert: pulumi.String("string"),
CallStationIdType: pulumi.String("string"),
Classes: pulumi.StringArray{
pulumi.String("string"),
},
ClientCert: pulumi.String("string"),
Delimiter: pulumi.String("string"),
DynamicMappings: .ObjectUserRadiusDynamicMappingTypeArray{
&.ObjectUserRadiusDynamicMappingTypeArgs{
_scopes: .ObjectUserRadiusDynamicMapping_ScopeArray{
&.ObjectUserRadiusDynamicMapping_ScopeArgs{
Name: pulumi.String("string"),
Vdom: pulumi.String("string"),
},
},
AccountKeyCertField: pulumi.String("string"),
AccountKeyProcessing: pulumi.String("string"),
AccountingServers: .ObjectUserRadiusDynamicMappingAccountingServerTypeArray{
&.ObjectUserRadiusDynamicMappingAccountingServerTypeArgs{
Id: pulumi.Float64(0),
Interface: pulumi.String("string"),
InterfaceSelectMethod: pulumi.String("string"),
Port: pulumi.Float64(0),
Secrets: pulumi.StringArray{
pulumi.String("string"),
},
Server: pulumi.String("string"),
SourceIp: pulumi.String("string"),
Status: pulumi.String("string"),
},
},
AcctAllServers: pulumi.String("string"),
AcctInterimInterval: pulumi.Float64(0),
AllUsergroup: pulumi.String("string"),
AuthType: pulumi.String("string"),
CaCert: pulumi.String("string"),
CallStationIdType: pulumi.String("string"),
Classes: pulumi.StringArray{
pulumi.String("string"),
},
ClientCert: pulumi.String("string"),
Delimiter: pulumi.String("string"),
DpCarrierEndpointAttribute: pulumi.String("string"),
DpCarrierEndpointBlockAttribute: pulumi.String("string"),
DpContextTimeout: pulumi.Float64(0),
DpFlushIpSession: pulumi.String("string"),
DpHoldTime: pulumi.Float64(0),
DpHttpHeader: pulumi.String("string"),
DpHttpHeaderFallback: pulumi.String("string"),
DpHttpHeaderStatus: pulumi.String("string"),
DpHttpHeaderSuppress: pulumi.String("string"),
DpLogDynFlags: pulumi.StringArray{
pulumi.String("string"),
},
DpLogPeriod: pulumi.Float64(0),
DpMemPercent: pulumi.Float64(0),
DpProfileAttribute: pulumi.String("string"),
DpProfileAttributeKey: pulumi.String("string"),
DpRadiusResponse: pulumi.String("string"),
DpRadiusServerPort: pulumi.Float64(0),
DpSecrets: pulumi.StringArray{
pulumi.String("string"),
},
DpValidateRequestSecret: pulumi.String("string"),
DynamicProfile: pulumi.String("string"),
EndpointTranslation: pulumi.String("string"),
EpCarrierEndpointConvertHex: pulumi.String("string"),
EpCarrierEndpointHeader: pulumi.String("string"),
EpCarrierEndpointHeaderSuppress: pulumi.String("string"),
EpCarrierEndpointPrefix: pulumi.String("string"),
EpCarrierEndpointPrefixRangeMax: pulumi.Float64(0),
EpCarrierEndpointPrefixRangeMin: pulumi.Float64(0),
EpCarrierEndpointPrefixString: pulumi.String("string"),
EpCarrierEndpointSource: pulumi.String("string"),
EpIpHeader: pulumi.String("string"),
EpIpHeaderSuppress: pulumi.String("string"),
EpMissingHeaderFallback: pulumi.String("string"),
EpProfileQueryType: pulumi.String("string"),
GroupOverrideAttrType: pulumi.String("string"),
H3cCompatibility: pulumi.String("string"),
Interface: pulumi.String("string"),
InterfaceSelectMethod: pulumi.String("string"),
MacCase: pulumi.String("string"),
MacPasswordDelimiter: pulumi.String("string"),
MacUsernameDelimiter: pulumi.String("string"),
NasId: pulumi.String("string"),
NasIdType: pulumi.String("string"),
NasIp: pulumi.String("string"),
PasswordEncoding: pulumi.String("string"),
PasswordRenewal: pulumi.String("string"),
RadiusCoa: pulumi.String("string"),
RadiusPort: pulumi.Float64(0),
Rsso: pulumi.String("string"),
RssoContextTimeout: pulumi.Float64(0),
RssoEndpointAttribute: pulumi.String("string"),
RssoEndpointBlockAttribute: pulumi.String("string"),
RssoEpOneIpOnly: pulumi.String("string"),
RssoFlushIpSession: pulumi.String("string"),
RssoLogFlags: pulumi.StringArray{
pulumi.String("string"),
},
RssoLogPeriod: pulumi.Float64(0),
RssoRadiusResponse: pulumi.String("string"),
RssoRadiusServerPort: pulumi.Float64(0),
RssoSecrets: pulumi.StringArray{
pulumi.String("string"),
},
RssoValidateRequestSecret: pulumi.String("string"),
SecondarySecrets: pulumi.StringArray{
pulumi.String("string"),
},
SecondaryServer: pulumi.String("string"),
Secrets: pulumi.StringArray{
pulumi.String("string"),
},
Server: pulumi.String("string"),
ServerIdentityCheck: pulumi.String("string"),
SourceIp: pulumi.String("string"),
SourceIpInterfaces: pulumi.StringArray{
pulumi.String("string"),
},
SsoAttribute: pulumi.String("string"),
SsoAttributeKey: pulumi.String("string"),
SsoAttributeValueOverride: pulumi.String("string"),
StatusTtl: pulumi.Float64(0),
SwitchControllerAcctFastFramedipDetect: pulumi.Float64(0),
SwitchControllerNasIpDynamic: pulumi.String("string"),
SwitchControllerServiceTypes: pulumi.StringArray{
pulumi.String("string"),
},
TertiarySecrets: pulumi.StringArray{
pulumi.String("string"),
},
TertiaryServer: pulumi.String("string"),
Timeout: pulumi.Float64(0),
TlsMinProtoVersion: pulumi.String("string"),
TransportProtocol: pulumi.String("string"),
UseGroupForProfile: pulumi.String("string"),
UseManagementVdom: pulumi.String("string"),
UsernameCaseSensitive: pulumi.String("string"),
},
},
DynamicSortSubtable: pulumi.String("string"),
GroupOverrideAttrType: pulumi.String("string"),
H3cCompatibility: pulumi.String("string"),
Interface: pulumi.String("string"),
InterfaceSelectMethod: pulumi.String("string"),
MacCase: pulumi.String("string"),
MacPasswordDelimiter: pulumi.String("string"),
MacUsernameDelimiter: pulumi.String("string"),
Name: pulumi.String("string"),
NasId: pulumi.String("string"),
NasIdType: pulumi.String("string"),
NasIp: pulumi.String("string"),
ObjectUserRadiusId: pulumi.String("string"),
PasswordEncoding: pulumi.String("string"),
PasswordRenewal: pulumi.String("string"),
RadiusCoa: pulumi.String("string"),
RadiusPort: pulumi.Float64(0),
Rsso: pulumi.String("string"),
RssoContextTimeout: pulumi.Float64(0),
RssoEndpointAttribute: pulumi.String("string"),
RssoEndpointBlockAttribute: pulumi.String("string"),
RssoEpOneIpOnly: pulumi.String("string"),
RssoFlushIpSession: pulumi.String("string"),
RssoLogFlags: pulumi.StringArray{
pulumi.String("string"),
},
RssoLogPeriod: pulumi.Float64(0),
RssoRadiusResponse: pulumi.String("string"),
RssoRadiusServerPort: pulumi.Float64(0),
RssoSecrets: pulumi.StringArray{
pulumi.String("string"),
},
RssoValidateRequestSecret: pulumi.String("string"),
Scopetype: pulumi.String("string"),
SecondarySecrets: pulumi.StringArray{
pulumi.String("string"),
},
SecondaryServer: pulumi.String("string"),
Secrets: pulumi.StringArray{
pulumi.String("string"),
},
Server: pulumi.String("string"),
ServerIdentityCheck: pulumi.String("string"),
SourceIp: pulumi.String("string"),
SourceIpInterfaces: pulumi.StringArray{
pulumi.String("string"),
},
SsoAttribute: pulumi.String("string"),
SsoAttributeKey: pulumi.String("string"),
SsoAttributeValueOverride: pulumi.String("string"),
StatusTtl: pulumi.Float64(0),
SwitchControllerAcctFastFramedipDetect: pulumi.Float64(0),
SwitchControllerNasIpDynamic: pulumi.String("string"),
SwitchControllerServiceTypes: pulumi.StringArray{
pulumi.String("string"),
},
TertiarySecrets: pulumi.StringArray{
pulumi.String("string"),
},
TertiaryServer: pulumi.String("string"),
Timeout: pulumi.Float64(0),
TlsMinProtoVersion: pulumi.String("string"),
TransportProtocol: pulumi.String("string"),
UseManagementVdom: pulumi.String("string"),
UsernameCaseSensitive: pulumi.String("string"),
})

    var objectUserRadiusResource = new ObjectUserRadius("objectUserRadiusResource", ObjectUserRadiusArgs.builder()
    .accountKeyCertField("string")
    .accountKeyProcessing("string")
    .accountingServers(ObjectUserRadiusAccountingServerArgs.builder()
        .id(0)
        .interface_("string")
        .interfaceSelectMethod("string")
        .port(0)
        .secrets("string")
        .server("string")
        .sourceIp("string")
        .status("string")
        .build())
    .acctAllServers("string")
    .acctInterimInterval(0)
    .adom("string")
    .allUsergroup("string")
    .authType("string")
    .caCert("string")
    .callStationIdType("string")
    .classes("string")
    .clientCert("string")
    .delimiter("string")
    .dynamicMappings(ObjectUserRadiusDynamicMappingArgs.builder()
        ._scopes(ObjectUserRadiusDynamicMapping_ScopeArgs.builder()
            .name("string")
            .vdom("string")
            .build())
        .accountKeyCertField("string")
        .accountKeyProcessing("string")
        .accountingServers(ObjectUserRadiusDynamicMappingAccountingServerArgs.builder()
            .id(0)
            .interface_("string")
            .interfaceSelectMethod("string")
            .port(0)
            .secrets("string")
            .server("string")
            .sourceIp("string")
            .status("string")
            .build())
        .acctAllServers("string")
        .acctInterimInterval(0)
        .allUsergroup("string")
        .authType("string")
        .caCert("string")
        .callStationIdType("string")
        .classes("string")
        .clientCert("string")
        .delimiter("string")
        .dpCarrierEndpointAttribute("string")
        .dpCarrierEndpointBlockAttribute("string")
        .dpContextTimeout(0)
        .dpFlushIpSession("string")
        .dpHoldTime(0)
        .dpHttpHeader("string")
        .dpHttpHeaderFallback("string")
        .dpHttpHeaderStatus("string")
        .dpHttpHeaderSuppress("string")
        .dpLogDynFlags("string")
        .dpLogPeriod(0)
        .dpMemPercent(0)
        .dpProfileAttribute("string")
        .dpProfileAttributeKey("string")
        .dpRadiusResponse("string")
        .dpRadiusServerPort(0)
        .dpSecrets("string")
        .dpValidateRequestSecret("string")
        .dynamicProfile("string")
        .endpointTranslation("string")
        .epCarrierEndpointConvertHex("string")
        .epCarrierEndpointHeader("string")
        .epCarrierEndpointHeaderSuppress("string")
        .epCarrierEndpointPrefix("string")
        .epCarrierEndpointPrefixRangeMax(0)
        .epCarrierEndpointPrefixRangeMin(0)
        .epCarrierEndpointPrefixString("string")
        .epCarrierEndpointSource("string")
        .epIpHeader("string")
        .epIpHeaderSuppress("string")
        .epMissingHeaderFallback("string")
        .epProfileQueryType("string")
        .groupOverrideAttrType("string")
        .h3cCompatibility("string")
        .interface_("string")
        .interfaceSelectMethod("string")
        .macCase("string")
        .macPasswordDelimiter("string")
        .macUsernameDelimiter("string")
        .nasId("string")
        .nasIdType("string")
        .nasIp("string")
        .passwordEncoding("string")
        .passwordRenewal("string")
        .radiusCoa("string")
        .radiusPort(0)
        .rsso("string")
        .rssoContextTimeout(0)
        .rssoEndpointAttribute("string")
        .rssoEndpointBlockAttribute("string")
        .rssoEpOneIpOnly("string")
        .rssoFlushIpSession("string")
        .rssoLogFlags("string")
        .rssoLogPeriod(0)
        .rssoRadiusResponse("string")
        .rssoRadiusServerPort(0)
        .rssoSecrets("string")
        .rssoValidateRequestSecret("string")
        .secondarySecrets("string")
        .secondaryServer("string")
        .secrets("string")
        .server("string")
        .serverIdentityCheck("string")
        .sourceIp("string")
        .sourceIpInterfaces("string")
        .ssoAttribute("string")
        .ssoAttributeKey("string")
        .ssoAttributeValueOverride("string")
        .statusTtl(0)
        .switchControllerAcctFastFramedipDetect(0)
        .switchControllerNasIpDynamic("string")
        .switchControllerServiceTypes("string")
        .tertiarySecrets("string")
        .tertiaryServer("string")
        .timeout(0)
        .tlsMinProtoVersion("string")
        .transportProtocol("string")
        .useGroupForProfile("string")
        .useManagementVdom("string")
        .usernameCaseSensitive("string")
        .build())
    .dynamicSortSubtable("string")
    .groupOverrideAttrType("string")
    .h3cCompatibility("string")
    .interface_("string")
    .interfaceSelectMethod("string")
    .macCase("string")
    .macPasswordDelimiter("string")
    .macUsernameDelimiter("string")
    .name("string")
    .nasId("string")
    .nasIdType("string")
    .nasIp("string")
    .objectUserRadiusId("string")
    .passwordEncoding("string")
    .passwordRenewal("string")
    .radiusCoa("string")
    .radiusPort(0)
    .rsso("string")
    .rssoContextTimeout(0)
    .rssoEndpointAttribute("string")
    .rssoEndpointBlockAttribute("string")
    .rssoEpOneIpOnly("string")
    .rssoFlushIpSession("string")
    .rssoLogFlags("string")
    .rssoLogPeriod(0)
    .rssoRadiusResponse("string")
    .rssoRadiusServerPort(0)
    .rssoSecrets("string")
    .rssoValidateRequestSecret("string")
    .scopetype("string")
    .secondarySecrets("string")
    .secondaryServer("string")
    .secrets("string")
    .server("string")
    .serverIdentityCheck("string")
    .sourceIp("string")
    .sourceIpInterfaces("string")
    .ssoAttribute("string")
    .ssoAttributeKey("string")
    .ssoAttributeValueOverride("string")
    .statusTtl(0)
    .switchControllerAcctFastFramedipDetect(0)
    .switchControllerNasIpDynamic("string")
    .switchControllerServiceTypes("string")
    .tertiarySecrets("string")
    .tertiaryServer("string")
    .timeout(0)
    .tlsMinProtoVersion("string")
    .transportProtocol("string")
    .useManagementVdom("string")
    .usernameCaseSensitive("string")
    .build());

    object_user_radius_resource = fortimanager.ObjectUserRadius("objectUserRadiusResource",
    account_key_cert_field="string",
    account_key_processing="string",
    accounting_servers=[{
        "id": 0,
        "interface": "string",
        "interface_select_method": "string",
        "port": 0,
        "secrets": ["string"],
        "server": "string",
        "source_ip": "string",
        "status": "string",
    }],
    acct_all_servers="string",
    acct_interim_interval=0,
    adom="string",
    all_usergroup="string",
    auth_type="string",
    ca_cert="string",
    call_station_id_type="string",
    classes=["string"],
    client_cert="string",
    delimiter="string",
    dynamic_mappings=[{
        "_scopes": [{
            "name": "string",
            "vdom": "string",
        }],
        "account_key_cert_field": "string",
        "account_key_processing": "string",
        "accounting_servers": [{
            "id": 0,
            "interface": "string",
            "interface_select_method": "string",
            "port": 0,
            "secrets": ["string"],
            "server": "string",
            "source_ip": "string",
            "status": "string",
        }],
        "acct_all_servers": "string",
        "acct_interim_interval": 0,
        "all_usergroup": "string",
        "auth_type": "string",
        "ca_cert": "string",
        "call_station_id_type": "string",
        "classes": ["string"],
        "client_cert": "string",
        "delimiter": "string",
        "dp_carrier_endpoint_attribute": "string",
        "dp_carrier_endpoint_block_attribute": "string",
        "dp_context_timeout": 0,
        "dp_flush_ip_session": "string",
        "dp_hold_time": 0,
        "dp_http_header": "string",
        "dp_http_header_fallback": "string",
        "dp_http_header_status": "string",
        "dp_http_header_suppress": "string",
        "dp_log_dyn_flags": ["string"],
        "dp_log_period": 0,
        "dp_mem_percent": 0,
        "dp_profile_attribute": "string",
        "dp_profile_attribute_key": "string",
        "dp_radius_response": "string",
        "dp_radius_server_port": 0,
        "dp_secrets": ["string"],
        "dp_validate_request_secret": "string",
        "dynamic_profile": "string",
        "endpoint_translation": "string",
        "ep_carrier_endpoint_convert_hex": "string",
        "ep_carrier_endpoint_header": "string",
        "ep_carrier_endpoint_header_suppress": "string",
        "ep_carrier_endpoint_prefix": "string",
        "ep_carrier_endpoint_prefix_range_max": 0,
        "ep_carrier_endpoint_prefix_range_min": 0,
        "ep_carrier_endpoint_prefix_string": "string",
        "ep_carrier_endpoint_source": "string",
        "ep_ip_header": "string",
        "ep_ip_header_suppress": "string",
        "ep_missing_header_fallback": "string",
        "ep_profile_query_type": "string",
        "group_override_attr_type": "string",
        "h3c_compatibility": "string",
        "interface": "string",
        "interface_select_method": "string",
        "mac_case": "string",
        "mac_password_delimiter": "string",
        "mac_username_delimiter": "string",
        "nas_id": "string",
        "nas_id_type": "string",
        "nas_ip": "string",
        "password_encoding": "string",
        "password_renewal": "string",
        "radius_coa": "string",
        "radius_port": 0,
        "rsso": "string",
        "rsso_context_timeout": 0,
        "rsso_endpoint_attribute": "string",
        "rsso_endpoint_block_attribute": "string",
        "rsso_ep_one_ip_only": "string",
        "rsso_flush_ip_session": "string",
        "rsso_log_flags": ["string"],
        "rsso_log_period": 0,
        "rsso_radius_response": "string",
        "rsso_radius_server_port": 0,
        "rsso_secrets": ["string"],
        "rsso_validate_request_secret": "string",
        "secondary_secrets": ["string"],
        "secondary_server": "string",
        "secrets": ["string"],
        "server": "string",
        "server_identity_check": "string",
        "source_ip": "string",
        "source_ip_interfaces": ["string"],
        "sso_attribute": "string",
        "sso_attribute_key": "string",
        "sso_attribute_value_override": "string",
        "status_ttl": 0,
        "switch_controller_acct_fast_framedip_detect": 0,
        "switch_controller_nas_ip_dynamic": "string",
        "switch_controller_service_types": ["string"],
        "tertiary_secrets": ["string"],
        "tertiary_server": "string",
        "timeout": 0,
        "tls_min_proto_version": "string",
        "transport_protocol": "string",
        "use_group_for_profile": "string",
        "use_management_vdom": "string",
        "username_case_sensitive": "string",
    }],
    dynamic_sort_subtable="string",
    group_override_attr_type="string",
    h3c_compatibility="string",
    interface="string",
    interface_select_method="string",
    mac_case="string",
    mac_password_delimiter="string",
    mac_username_delimiter="string",
    name="string",
    nas_id="string",
    nas_id_type="string",
    nas_ip="string",
    object_user_radius_id="string",
    password_encoding="string",
    password_renewal="string",
    radius_coa="string",
    radius_port=0,
    rsso="string",
    rsso_context_timeout=0,
    rsso_endpoint_attribute="string",
    rsso_endpoint_block_attribute="string",
    rsso_ep_one_ip_only="string",
    rsso_flush_ip_session="string",
    rsso_log_flags=["string"],
    rsso_log_period=0,
    rsso_radius_response="string",
    rsso_radius_server_port=0,
    rsso_secrets=["string"],
    rsso_validate_request_secret="string",
    scopetype="string",
    secondary_secrets=["string"],
    secondary_server="string",
    secrets=["string"],
    server="string",
    server_identity_check="string",
    source_ip="string",
    source_ip_interfaces=["string"],
    sso_attribute="string",
    sso_attribute_key="string",
    sso_attribute_value_override="string",
    status_ttl=0,
    switch_controller_acct_fast_framedip_detect=0,
    switch_controller_nas_ip_dynamic="string",
    switch_controller_service_types=["string"],
    tertiary_secrets=["string"],
    tertiary_server="string",
    timeout=0,
    tls_min_proto_version="string",
    transport_protocol="string",
    use_management_vdom="string",
    username_case_sensitive="string")

    const objectUserRadiusResource = new fortimanager.ObjectUserRadius("objectUserRadiusResource", {
    accountKeyCertField: "string",
    accountKeyProcessing: "string",
    accountingServers: [{
        id: 0,
        "interface": "string",
        interfaceSelectMethod: "string",
        port: 0,
        secrets: ["string"],
        server: "string",
        sourceIp: "string",
        status: "string",
    }],
    acctAllServers: "string",
    acctInterimInterval: 0,
    adom: "string",
    allUsergroup: "string",
    authType: "string",
    caCert: "string",
    callStationIdType: "string",
    classes: ["string"],
    clientCert: "string",
    delimiter: "string",
    dynamicMappings: [{
        _scopes: [{
            name: "string",
            vdom: "string",
        }],
        accountKeyCertField: "string",
        accountKeyProcessing: "string",
        accountingServers: [{
            id: 0,
            "interface": "string",
            interfaceSelectMethod: "string",
            port: 0,
            secrets: ["string"],
            server: "string",
            sourceIp: "string",
            status: "string",
        }],
        acctAllServers: "string",
        acctInterimInterval: 0,
        allUsergroup: "string",
        authType: "string",
        caCert: "string",
        callStationIdType: "string",
        classes: ["string"],
        clientCert: "string",
        delimiter: "string",
        dpCarrierEndpointAttribute: "string",
        dpCarrierEndpointBlockAttribute: "string",
        dpContextTimeout: 0,
        dpFlushIpSession: "string",
        dpHoldTime: 0,
        dpHttpHeader: "string",
        dpHttpHeaderFallback: "string",
        dpHttpHeaderStatus: "string",
        dpHttpHeaderSuppress: "string",
        dpLogDynFlags: ["string"],
        dpLogPeriod: 0,
        dpMemPercent: 0,
        dpProfileAttribute: "string",
        dpProfileAttributeKey: "string",
        dpRadiusResponse: "string",
        dpRadiusServerPort: 0,
        dpSecrets: ["string"],
        dpValidateRequestSecret: "string",
        dynamicProfile: "string",
        endpointTranslation: "string",
        epCarrierEndpointConvertHex: "string",
        epCarrierEndpointHeader: "string",
        epCarrierEndpointHeaderSuppress: "string",
        epCarrierEndpointPrefix: "string",
        epCarrierEndpointPrefixRangeMax: 0,
        epCarrierEndpointPrefixRangeMin: 0,
        epCarrierEndpointPrefixString: "string",
        epCarrierEndpointSource: "string",
        epIpHeader: "string",
        epIpHeaderSuppress: "string",
        epMissingHeaderFallback: "string",
        epProfileQueryType: "string",
        groupOverrideAttrType: "string",
        h3cCompatibility: "string",
        "interface": "string",
        interfaceSelectMethod: "string",
        macCase: "string",
        macPasswordDelimiter: "string",
        macUsernameDelimiter: "string",
        nasId: "string",
        nasIdType: "string",
        nasIp: "string",
        passwordEncoding: "string",
        passwordRenewal: "string",
        radiusCoa: "string",
        radiusPort: 0,
        rsso: "string",
        rssoContextTimeout: 0,
        rssoEndpointAttribute: "string",
        rssoEndpointBlockAttribute: "string",
        rssoEpOneIpOnly: "string",
        rssoFlushIpSession: "string",
        rssoLogFlags: ["string"],
        rssoLogPeriod: 0,
        rssoRadiusResponse: "string",
        rssoRadiusServerPort: 0,
        rssoSecrets: ["string"],
        rssoValidateRequestSecret: "string",
        secondarySecrets: ["string"],
        secondaryServer: "string",
        secrets: ["string"],
        server: "string",
        serverIdentityCheck: "string",
        sourceIp: "string",
        sourceIpInterfaces: ["string"],
        ssoAttribute: "string",
        ssoAttributeKey: "string",
        ssoAttributeValueOverride: "string",
        statusTtl: 0,
        switchControllerAcctFastFramedipDetect: 0,
        switchControllerNasIpDynamic: "string",
        switchControllerServiceTypes: ["string"],
        tertiarySecrets: ["string"],
        tertiaryServer: "string",
        timeout: 0,
        tlsMinProtoVersion: "string",
        transportProtocol: "string",
        useGroupForProfile: "string",
        useManagementVdom: "string",
        usernameCaseSensitive: "string",
    }],
    dynamicSortSubtable: "string",
    groupOverrideAttrType: "string",
    h3cCompatibility: "string",
    "interface": "string",
    interfaceSelectMethod: "string",
    macCase: "string",
    macPasswordDelimiter: "string",
    macUsernameDelimiter: "string",
    name: "string",
    nasId: "string",
    nasIdType: "string",
    nasIp: "string",
    objectUserRadiusId: "string",
    passwordEncoding: "string",
    passwordRenewal: "string",
    radiusCoa: "string",
    radiusPort: 0,
    rsso: "string",
    rssoContextTimeout: 0,
    rssoEndpointAttribute: "string",
    rssoEndpointBlockAttribute: "string",
    rssoEpOneIpOnly: "string",
    rssoFlushIpSession: "string",
    rssoLogFlags: ["string"],
    rssoLogPeriod: 0,
    rssoRadiusResponse: "string",
    rssoRadiusServerPort: 0,
    rssoSecrets: ["string"],
    rssoValidateRequestSecret: "string",
    scopetype: "string",
    secondarySecrets: ["string"],
    secondaryServer: "string",
    secrets: ["string"],
    server: "string",
    serverIdentityCheck: "string",
    sourceIp: "string",
    sourceIpInterfaces: ["string"],
    ssoAttribute: "string",
    ssoAttributeKey: "string",
    ssoAttributeValueOverride: "string",
    statusTtl: 0,
    switchControllerAcctFastFramedipDetect: 0,
    switchControllerNasIpDynamic: "string",
    switchControllerServiceTypes: ["string"],
    tertiarySecrets: ["string"],
    tertiaryServer: "string",
    timeout: 0,
    tlsMinProtoVersion: "string",
    transportProtocol: "string",
    useManagementVdom: "string",
    usernameCaseSensitive: "string",
});

    type: fortimanager:ObjectUserRadius
properties:
    accountKeyCertField: string
    accountKeyProcessing: string
    accountingServers:
        - id: 0
          interface: string
          interfaceSelectMethod: string
          port: 0
          secrets:
            - string
          server: string
          sourceIp: string
          status: string
    acctAllServers: string
    acctInterimInterval: 0
    adom: string
    allUsergroup: string
    authType: string
    caCert: string
    callStationIdType: string
    classes:
        - string
    clientCert: string
    delimiter: string
    dynamicMappings:
        - _scopes:
            - name: string
              vdom: string
          accountKeyCertField: string
          accountKeyProcessing: string
          accountingServers:
            - id: 0
              interface: string
              interfaceSelectMethod: string
              port: 0
              secrets:
                - string
              server: string
              sourceIp: string
              status: string
          acctAllServers: string
          acctInterimInterval: 0
          allUsergroup: string
          authType: string
          caCert: string
          callStationIdType: string
          classes:
            - string
          clientCert: string
          delimiter: string
          dpCarrierEndpointAttribute: string
          dpCarrierEndpointBlockAttribute: string
          dpContextTimeout: 0
          dpFlushIpSession: string
          dpHoldTime: 0
          dpHttpHeader: string
          dpHttpHeaderFallback: string
          dpHttpHeaderStatus: string
          dpHttpHeaderSuppress: string
          dpLogDynFlags:
            - string
          dpLogPeriod: 0
          dpMemPercent: 0
          dpProfileAttribute: string
          dpProfileAttributeKey: string
          dpRadiusResponse: string
          dpRadiusServerPort: 0
          dpSecrets:
            - string
          dpValidateRequestSecret: string
          dynamicProfile: string
          endpointTranslation: string
          epCarrierEndpointConvertHex: string
          epCarrierEndpointHeader: string
          epCarrierEndpointHeaderSuppress: string
          epCarrierEndpointPrefix: string
          epCarrierEndpointPrefixRangeMax: 0
          epCarrierEndpointPrefixRangeMin: 0
          epCarrierEndpointPrefixString: string
          epCarrierEndpointSource: string
          epIpHeader: string
          epIpHeaderSuppress: string
          epMissingHeaderFallback: string
          epProfileQueryType: string
          groupOverrideAttrType: string
          h3cCompatibility: string
          interface: string
          interfaceSelectMethod: string
          macCase: string
          macPasswordDelimiter: string
          macUsernameDelimiter: string
          nasId: string
          nasIdType: string
          nasIp: string
          passwordEncoding: string
          passwordRenewal: string
          radiusCoa: string
          radiusPort: 0
          rsso: string
          rssoContextTimeout: 0
          rssoEndpointAttribute: string
          rssoEndpointBlockAttribute: string
          rssoEpOneIpOnly: string
          rssoFlushIpSession: string
          rssoLogFlags:
            - string
          rssoLogPeriod: 0
          rssoRadiusResponse: string
          rssoRadiusServerPort: 0
          rssoSecrets:
            - string
          rssoValidateRequestSecret: string
          secondarySecrets:
            - string
          secondaryServer: string
          secrets:
            - string
          server: string
          serverIdentityCheck: string
          sourceIp: string
          sourceIpInterfaces:
            - string
          ssoAttribute: string
          ssoAttributeKey: string
          ssoAttributeValueOverride: string
          statusTtl: 0
          switchControllerAcctFastFramedipDetect: 0
          switchControllerNasIpDynamic: string
          switchControllerServiceTypes:
            - string
          tertiarySecrets:
            - string
          tertiaryServer: string
          timeout: 0
          tlsMinProtoVersion: string
          transportProtocol: string
          useGroupForProfile: string
          useManagementVdom: string
          usernameCaseSensitive: string
    dynamicSortSubtable: string
    groupOverrideAttrType: string
    h3cCompatibility: string
    interface: string
    interfaceSelectMethod: string
    macCase: string
    macPasswordDelimiter: string
    macUsernameDelimiter: string
    name: string
    nasId: string
    nasIdType: string
    nasIp: string
    objectUserRadiusId: string
    passwordEncoding: string
    passwordRenewal: string
    radiusCoa: string
    radiusPort: 0
    rsso: string
    rssoContextTimeout: 0
    rssoEndpointAttribute: string
    rssoEndpointBlockAttribute: string
    rssoEpOneIpOnly: string
    rssoFlushIpSession: string
    rssoLogFlags:
        - string
    rssoLogPeriod: 0
    rssoRadiusResponse: string
    rssoRadiusServerPort: 0
    rssoSecrets:
        - string
    rssoValidateRequestSecret: string
    scopetype: string
    secondarySecrets:
        - string
    secondaryServer: string
    secrets:
        - string
    server: string
    serverIdentityCheck: string
    sourceIp: string
    sourceIpInterfaces:
        - string
    ssoAttribute: string
    ssoAttributeKey: string
    ssoAttributeValueOverride: string
    statusTtl: 0
    switchControllerAcctFastFramedipDetect: 0
    switchControllerNasIpDynamic: string
    switchControllerServiceTypes:
        - string
    tertiarySecrets:
        - string
    tertiaryServer: string
    timeout: 0
    tlsMinProtoVersion: string
    transportProtocol: string
    useManagementVdom: string
    usernameCaseSensitive: string

    ObjectUserRadius Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The ObjectUserRadius resource accepts the following input properties:

    AccountKeyCertField string
    Define subject identity field in certificate for user access right checking. Valid values: othername, rfc822name, dnsname.
    AccountKeyProcessing string
    Account key processing operation. The FortiGate will keep either the whole domain or strip the domain from the subject identity. Valid values: same, strip.
    AccountingServers List<ObjectUserRadiusAccountingServer>
    Accounting-Server. The structure of accounting_server block is documented below.
    AcctAllServers string
    Enable/disable sending of accounting messages to all configured servers (default = disable). Valid values: disable, enable.
    AcctInterimInterval double
    Time in seconds between each accounting interim update message.
    Adom string
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    AllUsergroup string
    Enable/disable automatically including this RADIUS server in all user groups. Valid values: disable, enable.
    AuthType string
    Authentication methods/protocols permitted for this RADIUS server. Valid values: pap, chap, ms_chap, ms_chap_v2, auto.
    CaCert string
    CA of server to trust under TLS.
    CallStationIdType string
    Calling & Called station identifier type configuration (default = legacy), this option is not available for 802.1x authentication. Valid values: legacy, IP, MAC.
    Classes List<string>
    Class attribute name(s).
    ClientCert string
    Client certificate to use under TLS.
    Delimiter string
    Configure delimiter to be used for separating profile group names in the SSO attribute (default = plus character "+"). Valid values: plus, comma.
    DynamicMappings List<ObjectUserRadiusDynamicMapping>
    Dynamic_Mapping. The structure of dynamic_mapping block is documented below.
    DynamicSortSubtable string
    true or false, set this parameter to true when using dynamic for_each + toset to configure and sort sub-tables, please do not set this parameter when configuring static sub-tables.
    GroupOverrideAttrType string
    RADIUS attribute type to override user group information. Valid values: filter-Id, class.
    H3cCompatibility string
    Enable/disable compatibility with the H3C, a mechanism that performs security checking for authentication. Valid values: disable, enable.
    Interface string
    Specify outgoing interface to reach server.
    InterfaceSelectMethod string
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    MacCase string
    MAC authentication case (default = lowercase). Valid values: uppercase, lowercase.
    MacPasswordDelimiter string
    MAC authentication password delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    MacUsernameDelimiter string
    MAC authentication username delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    Name string
    RADIUS server entry name.
    NasId string
    Custom NAS identifier.
    NasIdType string
    NAS identifier type configuration (default = legacy). Valid values: legacy, custom, hostname.
    NasIp string
    IP address used to communicate with the RADIUS server and used as NAS-IP-Address and Called-Station-ID attributes.
    ObjectUserRadiusId string
    an identifier for the resource with format {{name}}.
    PasswordEncoding string
    Password encoding. Valid values: ISO-8859-1, auto.
    PasswordRenewal string
    Enable/disable password renewal. Valid values: disable, enable.
    RadiusCoa string
    Enable to allow a mechanism to change the attributes of an authentication, authorization, and accounting session after it is authenticated. Valid values: disable, enable.
    RadiusPort double
    RADIUS service port number.
    Rsso string
    Enable/disable RADIUS based single sign on feature. Valid values: disable, enable.
    RssoContextTimeout double
    Time in seconds before the logged out user is removed from the "user context list" of logged on users.
    RssoEndpointAttribute string
    RADIUS attributes used to extract the user end point identifer from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    RssoEndpointBlockAttribute string
    RADIUS attributes used to block a user. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    RssoEpOneIpOnly string
    Enable/disable the replacement of old IP addresses with new ones for the same endpoint on RADIUS accounting Start messages. Valid values: disable, enable.
    RssoFlushIpSession string
    Enable/disable flushing user IP sessions on RADIUS accounting Stop messages. Valid values: disable, enable.
    RssoLogFlags List<string>
    Events to log. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    RssoLogPeriod double
    Time interval in seconds that group event log messages will be generated for dynamic profile events.
    RssoRadiusResponse string
    Enable/disable sending RADIUS response packets after receiving Start and Stop records. Valid values: disable, enable.
    RssoRadiusServerPort double
    UDP port to listen on for RADIUS Start and Stop records.
    RssoSecrets List<string>
    RADIUS secret used by the RADIUS accounting server.
    RssoValidateRequestSecret string
    Enable/disable validating the RADIUS request shared secret in the Start or End record. Valid values: disable, enable.
    Scopetype string
    The scope of application of the resource. Valid values: inherit, adom, global. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    SecondarySecrets List<string>
    Secret key to access the secondary server.
    SecondaryServer string
    {<name_str|ip_str>} secondary RADIUS CN domain name or IP.
    Secrets List<string>
    Pre-shared secret key used to access the primary RADIUS server.
    Server string
    Primary RADIUS server CN domain name or IP address.
    ServerIdentityCheck string
    Enable/disable RADIUS server identity check (verify server domain name/IP address against the server certificate). Valid values: disable, enable.
    SourceIp string
    Source IP address for communications to the RADIUS server.
    SourceIpInterfaces List<string>
    Source interface for communication with the RADIUS server.
    SsoAttribute string
    RADIUS attribute that contains the profile group name to be extracted from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    SsoAttributeKey string
    Key prefix for SSO group value in the SSO attribute.
    SsoAttributeValueOverride string
    Enable/disable override old attribute value with new value for the same endpoint. Valid values: disable, enable.
    StatusTtl double
    Time for which server reachability is cached so that when a server is unreachable, it will not be retried for at least this period of time (0 = cache disabled, default = 300).
    SwitchControllerAcctFastFramedipDetect double
    Switch controller accounting message Framed-IP detection from DHCP snooping (seconds, default=2).
    SwitchControllerNasIpDynamic string
    Enable/Disable switch-controller nas-ip dynamic to dynamically set nas-ip. Valid values: disable, enable.
    SwitchControllerServiceTypes List<string>
    RADIUS service type. Valid values: login, framed, callback-login, callback-framed, outbound, administrative, nas-prompt, authenticate-only, callback-nas-prompt, call-check, callback-administrative.
    TertiarySecrets List<string>
    Secret key to access the tertiary server.
    TertiaryServer string
    {<name_str|ip_str>} tertiary RADIUS CN domain name or IP.
    Timeout double
    Time in seconds between re-sending authentication requests.
    TlsMinProtoVersion string
    Minimum supported protocol version for TLS connections (default is to follow system global setting). Valid values: default, TLSv1, TLSv1-1, TLSv1-2, SSLv3.
    TransportProtocol string
    Transport protocol to be used (default = udp). Valid values: udp, tcp, tls.
    UseManagementVdom string
    Enable/disable using management VDOM to send requests. Valid values: disable, enable.
    UsernameCaseSensitive string
    Enable/disable case sensitive user names. Valid values: disable, enable.
    AccountKeyCertField string
    Define subject identity field in certificate for user access right checking. Valid values: othername, rfc822name, dnsname.
    AccountKeyProcessing string
    Account key processing operation. The FortiGate will keep either the whole domain or strip the domain from the subject identity. Valid values: same, strip.
    AccountingServers []ObjectUserRadiusAccountingServerTypeArgs
    Accounting-Server. The structure of accounting_server block is documented below.
    AcctAllServers string
    Enable/disable sending of accounting messages to all configured servers (default = disable). Valid values: disable, enable.
    AcctInterimInterval float64
    Time in seconds between each accounting interim update message.
    Adom string
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    AllUsergroup string
    Enable/disable automatically including this RADIUS server in all user groups. Valid values: disable, enable.
    AuthType string
    Authentication methods/protocols permitted for this RADIUS server. Valid values: pap, chap, ms_chap, ms_chap_v2, auto.
    CaCert string
    CA of server to trust under TLS.
    CallStationIdType string
    Calling & Called station identifier type configuration (default = legacy), this option is not available for 802.1x authentication. Valid values: legacy, IP, MAC.
    Classes []string
    Class attribute name(s).
    ClientCert string
    Client certificate to use under TLS.
    Delimiter string
    Configure delimiter to be used for separating profile group names in the SSO attribute (default = plus character "+"). Valid values: plus, comma.
    DynamicMappings []ObjectUserRadiusDynamicMappingTypeArgs
    Dynamic_Mapping. The structure of dynamic_mapping block is documented below.
    DynamicSortSubtable string
    true or false, set this parameter to true when using dynamic for_each + toset to configure and sort sub-tables, please do not set this parameter when configuring static sub-tables.
    GroupOverrideAttrType string
    RADIUS attribute type to override user group information. Valid values: filter-Id, class.
    H3cCompatibility string
    Enable/disable compatibility with the H3C, a mechanism that performs security checking for authentication. Valid values: disable, enable.
    Interface string
    Specify outgoing interface to reach server.
    InterfaceSelectMethod string
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    MacCase string
    MAC authentication case (default = lowercase). Valid values: uppercase, lowercase.
    MacPasswordDelimiter string
    MAC authentication password delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    MacUsernameDelimiter string
    MAC authentication username delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    Name string
    RADIUS server entry name.
    NasId string
    Custom NAS identifier.
    NasIdType string
    NAS identifier type configuration (default = legacy). Valid values: legacy, custom, hostname.
    NasIp string
    IP address used to communicate with the RADIUS server and used as NAS-IP-Address and Called-Station-ID attributes.
    ObjectUserRadiusId string
    an identifier for the resource with format {{name}}.
    PasswordEncoding string
    Password encoding. Valid values: ISO-8859-1, auto.
    PasswordRenewal string
    Enable/disable password renewal. Valid values: disable, enable.
    RadiusCoa string
    Enable to allow a mechanism to change the attributes of an authentication, authorization, and accounting session after it is authenticated. Valid values: disable, enable.
    RadiusPort float64
    RADIUS service port number.
    Rsso string
    Enable/disable RADIUS based single sign on feature. Valid values: disable, enable.
    RssoContextTimeout float64
    Time in seconds before the logged out user is removed from the "user context list" of logged on users.
    RssoEndpointAttribute string
    RADIUS attributes used to extract the user end point identifer from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    RssoEndpointBlockAttribute string
    RADIUS attributes used to block a user. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    RssoEpOneIpOnly string
    Enable/disable the replacement of old IP addresses with new ones for the same endpoint on RADIUS accounting Start messages. Valid values: disable, enable.
    RssoFlushIpSession string
    Enable/disable flushing user IP sessions on RADIUS accounting Stop messages. Valid values: disable, enable.
    RssoLogFlags []string
    Events to log. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    RssoLogPeriod float64
    Time interval in seconds that group event log messages will be generated for dynamic profile events.
    RssoRadiusResponse string
    Enable/disable sending RADIUS response packets after receiving Start and Stop records. Valid values: disable, enable.
    RssoRadiusServerPort float64
    UDP port to listen on for RADIUS Start and Stop records.
    RssoSecrets []string
    RADIUS secret used by the RADIUS accounting server.
    RssoValidateRequestSecret string
    Enable/disable validating the RADIUS request shared secret in the Start or End record. Valid values: disable, enable.
    Scopetype string
    The scope of application of the resource. Valid values: inherit, adom, global. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    SecondarySecrets []string
    Secret key to access the secondary server.
    SecondaryServer string
    {<name_str|ip_str>} secondary RADIUS CN domain name or IP.
    Secrets []string
    Pre-shared secret key used to access the primary RADIUS server.
    Server string
    Primary RADIUS server CN domain name or IP address.
    ServerIdentityCheck string
    Enable/disable RADIUS server identity check (verify server domain name/IP address against the server certificate). Valid values: disable, enable.
    SourceIp string
    Source IP address for communications to the RADIUS server.
    SourceIpInterfaces []string
    Source interface for communication with the RADIUS server.
    SsoAttribute string
    RADIUS attribute that contains the profile group name to be extracted from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    SsoAttributeKey string
    Key prefix for SSO group value in the SSO attribute.
    SsoAttributeValueOverride string
    Enable/disable override old attribute value with new value for the same endpoint. Valid values: disable, enable.
    StatusTtl float64
    Time for which server reachability is cached so that when a server is unreachable, it will not be retried for at least this period of time (0 = cache disabled, default = 300).
    SwitchControllerAcctFastFramedipDetect float64
    Switch controller accounting message Framed-IP detection from DHCP snooping (seconds, default=2).
    SwitchControllerNasIpDynamic string
    Enable/Disable switch-controller nas-ip dynamic to dynamically set nas-ip. Valid values: disable, enable.
    SwitchControllerServiceTypes []string
    RADIUS service type. Valid values: login, framed, callback-login, callback-framed, outbound, administrative, nas-prompt, authenticate-only, callback-nas-prompt, call-check, callback-administrative.
    TertiarySecrets []string
    Secret key to access the tertiary server.
    TertiaryServer string
    {<name_str|ip_str>} tertiary RADIUS CN domain name or IP.
    Timeout float64
    Time in seconds between re-sending authentication requests.
    TlsMinProtoVersion string
    Minimum supported protocol version for TLS connections (default is to follow system global setting). Valid values: default, TLSv1, TLSv1-1, TLSv1-2, SSLv3.
    TransportProtocol string
    Transport protocol to be used (default = udp). Valid values: udp, tcp, tls.
    UseManagementVdom string
    Enable/disable using management VDOM to send requests. Valid values: disable, enable.
    UsernameCaseSensitive string
    Enable/disable case sensitive user names. Valid values: disable, enable.
    accountKeyCertField String
    Define subject identity field in certificate for user access right checking. Valid values: othername, rfc822name, dnsname.
    accountKeyProcessing String
    Account key processing operation. The FortiGate will keep either the whole domain or strip the domain from the subject identity. Valid values: same, strip.
    accountingServers List<ObjectUserRadiusAccountingServer>
    Accounting-Server. The structure of accounting_server block is documented below.
    acctAllServers String
    Enable/disable sending of accounting messages to all configured servers (default = disable). Valid values: disable, enable.
    acctInterimInterval Double
    Time in seconds between each accounting interim update message.
    adom String
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    allUsergroup String
    Enable/disable automatically including this RADIUS server in all user groups. Valid values: disable, enable.
    authType String
    Authentication methods/protocols permitted for this RADIUS server. Valid values: pap, chap, ms_chap, ms_chap_v2, auto.
    caCert String
    CA of server to trust under TLS.
    callStationIdType String
    Calling & Called station identifier type configuration (default = legacy), this option is not available for 802.1x authentication. Valid values: legacy, IP, MAC.
    classes List<String>
    Class attribute name(s).
    clientCert String
    Client certificate to use under TLS.
    delimiter String
    Configure delimiter to be used for separating profile group names in the SSO attribute (default = plus character "+"). Valid values: plus, comma.
    dynamicMappings List<ObjectUserRadiusDynamicMapping>
    Dynamic_Mapping. The structure of dynamic_mapping block is documented below.
    dynamicSortSubtable String
    true or false, set this parameter to true when using dynamic for_each + toset to configure and sort sub-tables, please do not set this parameter when configuring static sub-tables.
    groupOverrideAttrType String
    RADIUS attribute type to override user group information. Valid values: filter-Id, class.
    h3cCompatibility String
    Enable/disable compatibility with the H3C, a mechanism that performs security checking for authentication. Valid values: disable, enable.
    interfaceSelectMethod String
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    interface_ String
    Specify outgoing interface to reach server.
    macCase String
    MAC authentication case (default = lowercase). Valid values: uppercase, lowercase.
    macPasswordDelimiter String
    MAC authentication password delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    macUsernameDelimiter String
    MAC authentication username delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    name String
    RADIUS server entry name.
    nasId String
    Custom NAS identifier.
    nasIdType String
    NAS identifier type configuration (default = legacy). Valid values: legacy, custom, hostname.
    nasIp String
    IP address used to communicate with the RADIUS server and used as NAS-IP-Address and Called-Station-ID attributes.
    objectUserRadiusId String
    an identifier for the resource with format {{name}}.
    passwordEncoding String
    Password encoding. Valid values: ISO-8859-1, auto.
    passwordRenewal String
    Enable/disable password renewal. Valid values: disable, enable.
    radiusCoa String
    Enable to allow a mechanism to change the attributes of an authentication, authorization, and accounting session after it is authenticated. Valid values: disable, enable.
    radiusPort Double
    RADIUS service port number.
    rsso String
    Enable/disable RADIUS based single sign on feature. Valid values: disable, enable.
    rssoContextTimeout Double
    Time in seconds before the logged out user is removed from the "user context list" of logged on users.
    rssoEndpointAttribute String
    RADIUS attributes used to extract the user end point identifer from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rssoEndpointBlockAttribute String
    RADIUS attributes used to block a user. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rssoEpOneIpOnly String
    Enable/disable the replacement of old IP addresses with new ones for the same endpoint on RADIUS accounting Start messages. Valid values: disable, enable.
    rssoFlushIpSession String
    Enable/disable flushing user IP sessions on RADIUS accounting Stop messages. Valid values: disable, enable.
    rssoLogFlags List<String>
    Events to log. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    rssoLogPeriod Double
    Time interval in seconds that group event log messages will be generated for dynamic profile events.
    rssoRadiusResponse String
    Enable/disable sending RADIUS response packets after receiving Start and Stop records. Valid values: disable, enable.
    rssoRadiusServerPort Double
    UDP port to listen on for RADIUS Start and Stop records.
    rssoSecrets List<String>
    RADIUS secret used by the RADIUS accounting server.
    rssoValidateRequestSecret String
    Enable/disable validating the RADIUS request shared secret in the Start or End record. Valid values: disable, enable.
    scopetype String
    The scope of application of the resource. Valid values: inherit, adom, global. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    secondarySecrets List<String>
    Secret key to access the secondary server.
    secondaryServer String
    {<name_str|ip_str>} secondary RADIUS CN domain name or IP.
    secrets List<String>
    Pre-shared secret key used to access the primary RADIUS server.
    server String
    Primary RADIUS server CN domain name or IP address.
    serverIdentityCheck String
    Enable/disable RADIUS server identity check (verify server domain name/IP address against the server certificate). Valid values: disable, enable.
    sourceIp String
    Source IP address for communications to the RADIUS server.
    sourceIpInterfaces List<String>
    Source interface for communication with the RADIUS server.
    ssoAttribute String
    RADIUS attribute that contains the profile group name to be extracted from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    ssoAttributeKey String
    Key prefix for SSO group value in the SSO attribute.
    ssoAttributeValueOverride String
    Enable/disable override old attribute value with new value for the same endpoint. Valid values: disable, enable.
    statusTtl Double
    Time for which server reachability is cached so that when a server is unreachable, it will not be retried for at least this period of time (0 = cache disabled, default = 300).
    switchControllerAcctFastFramedipDetect Double
    Switch controller accounting message Framed-IP detection from DHCP snooping (seconds, default=2).
    switchControllerNasIpDynamic String
    Enable/Disable switch-controller nas-ip dynamic to dynamically set nas-ip. Valid values: disable, enable.
    switchControllerServiceTypes List<String>
    RADIUS service type. Valid values: login, framed, callback-login, callback-framed, outbound, administrative, nas-prompt, authenticate-only, callback-nas-prompt, call-check, callback-administrative.
    tertiarySecrets List<String>
    Secret key to access the tertiary server.
    tertiaryServer String
    {<name_str|ip_str>} tertiary RADIUS CN domain name or IP.
    timeout Double
    Time in seconds between re-sending authentication requests.
    tlsMinProtoVersion String
    Minimum supported protocol version for TLS connections (default is to follow system global setting). Valid values: default, TLSv1, TLSv1-1, TLSv1-2, SSLv3.
    transportProtocol String
    Transport protocol to be used (default = udp). Valid values: udp, tcp, tls.
    useManagementVdom String
    Enable/disable using management VDOM to send requests. Valid values: disable, enable.
    usernameCaseSensitive String
    Enable/disable case sensitive user names. Valid values: disable, enable.
    accountKeyCertField string
    Define subject identity field in certificate for user access right checking. Valid values: othername, rfc822name, dnsname.
    accountKeyProcessing string
    Account key processing operation. The FortiGate will keep either the whole domain or strip the domain from the subject identity. Valid values: same, strip.
    accountingServers ObjectUserRadiusAccountingServer[]
    Accounting-Server. The structure of accounting_server block is documented below.
    acctAllServers string
    Enable/disable sending of accounting messages to all configured servers (default = disable). Valid values: disable, enable.
    acctInterimInterval number
    Time in seconds between each accounting interim update message.
    adom string
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    allUsergroup string
    Enable/disable automatically including this RADIUS server in all user groups. Valid values: disable, enable.
    authType string
    Authentication methods/protocols permitted for this RADIUS server. Valid values: pap, chap, ms_chap, ms_chap_v2, auto.
    caCert string
    CA of server to trust under TLS.
    callStationIdType string
    Calling & Called station identifier type configuration (default = legacy), this option is not available for 802.1x authentication. Valid values: legacy, IP, MAC.
    classes string[]
    Class attribute name(s).
    clientCert string
    Client certificate to use under TLS.
    delimiter string
    Configure delimiter to be used for separating profile group names in the SSO attribute (default = plus character "+"). Valid values: plus, comma.
    dynamicMappings ObjectUserRadiusDynamicMapping[]
    Dynamic_Mapping. The structure of dynamic_mapping block is documented below.
    dynamicSortSubtable string
    true or false, set this parameter to true when using dynamic for_each + toset to configure and sort sub-tables, please do not set this parameter when configuring static sub-tables.
    groupOverrideAttrType string
    RADIUS attribute type to override user group information. Valid values: filter-Id, class.
    h3cCompatibility string
    Enable/disable compatibility with the H3C, a mechanism that performs security checking for authentication. Valid values: disable, enable.
    interface string
    Specify outgoing interface to reach server.
    interfaceSelectMethod string
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    macCase string
    MAC authentication case (default = lowercase). Valid values: uppercase, lowercase.
    macPasswordDelimiter string
    MAC authentication password delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    macUsernameDelimiter string
    MAC authentication username delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    name string
    RADIUS server entry name.
    nasId string
    Custom NAS identifier.
    nasIdType string
    NAS identifier type configuration (default = legacy). Valid values: legacy, custom, hostname.
    nasIp string
    IP address used to communicate with the RADIUS server and used as NAS-IP-Address and Called-Station-ID attributes.
    objectUserRadiusId string
    an identifier for the resource with format {{name}}.
    passwordEncoding string
    Password encoding. Valid values: ISO-8859-1, auto.
    passwordRenewal string
    Enable/disable password renewal. Valid values: disable, enable.
    radiusCoa string
    Enable to allow a mechanism to change the attributes of an authentication, authorization, and accounting session after it is authenticated. Valid values: disable, enable.
    radiusPort number
    RADIUS service port number.
    rsso string
    Enable/disable RADIUS based single sign on feature. Valid values: disable, enable.
    rssoContextTimeout number
    Time in seconds before the logged out user is removed from the "user context list" of logged on users.
    rssoEndpointAttribute string
    RADIUS attributes used to extract the user end point identifer from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rssoEndpointBlockAttribute string
    RADIUS attributes used to block a user. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rssoEpOneIpOnly string
    Enable/disable the replacement of old IP addresses with new ones for the same endpoint on RADIUS accounting Start messages. Valid values: disable, enable.
    rssoFlushIpSession string
    Enable/disable flushing user IP sessions on RADIUS accounting Stop messages. Valid values: disable, enable.
    rssoLogFlags string[]
    Events to log. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    rssoLogPeriod number
    Time interval in seconds that group event log messages will be generated for dynamic profile events.
    rssoRadiusResponse string
    Enable/disable sending RADIUS response packets after receiving Start and Stop records. Valid values: disable, enable.
    rssoRadiusServerPort number
    UDP port to listen on for RADIUS Start and Stop records.
    rssoSecrets string[]
    RADIUS secret used by the RADIUS accounting server.
    rssoValidateRequestSecret string
    Enable/disable validating the RADIUS request shared secret in the Start or End record. Valid values: disable, enable.
    scopetype string
    The scope of application of the resource. Valid values: inherit, adom, global. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    secondarySecrets string[]
    Secret key to access the secondary server.
    secondaryServer string
    {<name_str|ip_str>} secondary RADIUS CN domain name or IP.
    secrets string[]
    Pre-shared secret key used to access the primary RADIUS server.
    server string
    Primary RADIUS server CN domain name or IP address.
    serverIdentityCheck string
    Enable/disable RADIUS server identity check (verify server domain name/IP address against the server certificate). Valid values: disable, enable.
    sourceIp string
    Source IP address for communications to the RADIUS server.
    sourceIpInterfaces string[]
    Source interface for communication with the RADIUS server.
    ssoAttribute string
    RADIUS attribute that contains the profile group name to be extracted from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    ssoAttributeKey string
    Key prefix for SSO group value in the SSO attribute.
    ssoAttributeValueOverride string
    Enable/disable override old attribute value with new value for the same endpoint. Valid values: disable, enable.
    statusTtl number
    Time for which server reachability is cached so that when a server is unreachable, it will not be retried for at least this period of time (0 = cache disabled, default = 300).
    switchControllerAcctFastFramedipDetect number
    Switch controller accounting message Framed-IP detection from DHCP snooping (seconds, default=2).
    switchControllerNasIpDynamic string
    Enable/Disable switch-controller nas-ip dynamic to dynamically set nas-ip. Valid values: disable, enable.
    switchControllerServiceTypes string[]
    RADIUS service type. Valid values: login, framed, callback-login, callback-framed, outbound, administrative, nas-prompt, authenticate-only, callback-nas-prompt, call-check, callback-administrative.
    tertiarySecrets string[]
    Secret key to access the tertiary server.
    tertiaryServer string
    {<name_str|ip_str>} tertiary RADIUS CN domain name or IP.
    timeout number
    Time in seconds between re-sending authentication requests.
    tlsMinProtoVersion string
    Minimum supported protocol version for TLS connections (default is to follow system global setting). Valid values: default, TLSv1, TLSv1-1, TLSv1-2, SSLv3.
    transportProtocol string
    Transport protocol to be used (default = udp). Valid values: udp, tcp, tls.
    useManagementVdom string
    Enable/disable using management VDOM to send requests. Valid values: disable, enable.
    usernameCaseSensitive string
    Enable/disable case sensitive user names. Valid values: disable, enable.
    account_key_cert_field str
    Define subject identity field in certificate for user access right checking. Valid values: othername, rfc822name, dnsname.
    account_key_processing str
    Account key processing operation. The FortiGate will keep either the whole domain or strip the domain from the subject identity. Valid values: same, strip.
    accounting_servers Sequence[ObjectUserRadiusAccountingServerArgs]
    Accounting-Server. The structure of accounting_server block is documented below.
    acct_all_servers str
    Enable/disable sending of accounting messages to all configured servers (default = disable). Valid values: disable, enable.
    acct_interim_interval float
    Time in seconds between each accounting interim update message.
    adom str
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    all_usergroup str
    Enable/disable automatically including this RADIUS server in all user groups. Valid values: disable, enable.
    auth_type str
    Authentication methods/protocols permitted for this RADIUS server. Valid values: pap, chap, ms_chap, ms_chap_v2, auto.
    ca_cert str
    CA of server to trust under TLS.
    call_station_id_type str
    Calling & Called station identifier type configuration (default = legacy), this option is not available for 802.1x authentication. Valid values: legacy, IP, MAC.
    classes Sequence[str]
    Class attribute name(s).
    client_cert str
    Client certificate to use under TLS.
    delimiter str
    Configure delimiter to be used for separating profile group names in the SSO attribute (default = plus character "+"). Valid values: plus, comma.
    dynamic_mappings Sequence[ObjectUserRadiusDynamicMappingArgs]
    Dynamic_Mapping. The structure of dynamic_mapping block is documented below.
    dynamic_sort_subtable str
    true or false, set this parameter to true when using dynamic for_each + toset to configure and sort sub-tables, please do not set this parameter when configuring static sub-tables.
    group_override_attr_type str
    RADIUS attribute type to override user group information. Valid values: filter-Id, class.
    h3c_compatibility str
    Enable/disable compatibility with the H3C, a mechanism that performs security checking for authentication. Valid values: disable, enable.
    interface str
    Specify outgoing interface to reach server.
    interface_select_method str
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    mac_case str
    MAC authentication case (default = lowercase). Valid values: uppercase, lowercase.
    mac_password_delimiter str
    MAC authentication password delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    mac_username_delimiter str
    MAC authentication username delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    name str
    RADIUS server entry name.
    nas_id str
    Custom NAS identifier.
    nas_id_type str
    NAS identifier type configuration (default = legacy). Valid values: legacy, custom, hostname.
    nas_ip str
    IP address used to communicate with the RADIUS server and used as NAS-IP-Address and Called-Station-ID attributes.
    object_user_radius_id str
    an identifier for the resource with format {{name}}.
    password_encoding str
    Password encoding. Valid values: ISO-8859-1, auto.
    password_renewal str
    Enable/disable password renewal. Valid values: disable, enable.
    radius_coa str
    Enable to allow a mechanism to change the attributes of an authentication, authorization, and accounting session after it is authenticated. Valid values: disable, enable.
    radius_port float
    RADIUS service port number.
    rsso str
    Enable/disable RADIUS based single sign on feature. Valid values: disable, enable.
    rsso_context_timeout float
    Time in seconds before the logged out user is removed from the "user context list" of logged on users.
    rsso_endpoint_attribute str
    RADIUS attributes used to extract the user end point identifer from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rsso_endpoint_block_attribute str
    RADIUS attributes used to block a user. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rsso_ep_one_ip_only str
    Enable/disable the replacement of old IP addresses with new ones for the same endpoint on RADIUS accounting Start messages. Valid values: disable, enable.
    rsso_flush_ip_session str
    Enable/disable flushing user IP sessions on RADIUS accounting Stop messages. Valid values: disable, enable.
    rsso_log_flags Sequence[str]
    Events to log. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    rsso_log_period float
    Time interval in seconds that group event log messages will be generated for dynamic profile events.
    rsso_radius_response str
    Enable/disable sending RADIUS response packets after receiving Start and Stop records. Valid values: disable, enable.
    rsso_radius_server_port float
    UDP port to listen on for RADIUS Start and Stop records.
    rsso_secrets Sequence[str]
    RADIUS secret used by the RADIUS accounting server.
    rsso_validate_request_secret str
    Enable/disable validating the RADIUS request shared secret in the Start or End record. Valid values: disable, enable.
    scopetype str
    The scope of application of the resource. Valid values: inherit, adom, global. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    secondary_secrets Sequence[str]
    Secret key to access the secondary server.
    secondary_server str
    {<name_str|ip_str>} secondary RADIUS CN domain name or IP.
    secrets Sequence[str]
    Pre-shared secret key used to access the primary RADIUS server.
    server str
    Primary RADIUS server CN domain name or IP address.
    server_identity_check str
    Enable/disable RADIUS server identity check (verify server domain name/IP address against the server certificate). Valid values: disable, enable.
    source_ip str
    Source IP address for communications to the RADIUS server.
    source_ip_interfaces Sequence[str]
    Source interface for communication with the RADIUS server.
    sso_attribute str
    RADIUS attribute that contains the profile group name to be extracted from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    sso_attribute_key str
    Key prefix for SSO group value in the SSO attribute.
    sso_attribute_value_override str
    Enable/disable override old attribute value with new value for the same endpoint. Valid values: disable, enable.
    status_ttl float
    Time for which server reachability is cached so that when a server is unreachable, it will not be retried for at least this period of time (0 = cache disabled, default = 300).
    switch_controller_acct_fast_framedip_detect float
    Switch controller accounting message Framed-IP detection from DHCP snooping (seconds, default=2).
    switch_controller_nas_ip_dynamic str
    Enable/Disable switch-controller nas-ip dynamic to dynamically set nas-ip. Valid values: disable, enable.
    switch_controller_service_types Sequence[str]
    RADIUS service type. Valid values: login, framed, callback-login, callback-framed, outbound, administrative, nas-prompt, authenticate-only, callback-nas-prompt, call-check, callback-administrative.
    tertiary_secrets Sequence[str]
    Secret key to access the tertiary server.
    tertiary_server str
    {<name_str|ip_str>} tertiary RADIUS CN domain name or IP.
    timeout float
    Time in seconds between re-sending authentication requests.
    tls_min_proto_version str
    Minimum supported protocol version for TLS connections (default is to follow system global setting). Valid values: default, TLSv1, TLSv1-1, TLSv1-2, SSLv3.
    transport_protocol str
    Transport protocol to be used (default = udp). Valid values: udp, tcp, tls.
    use_management_vdom str
    Enable/disable using management VDOM to send requests. Valid values: disable, enable.
    username_case_sensitive str
    Enable/disable case sensitive user names. Valid values: disable, enable.
    accountKeyCertField String
    Define subject identity field in certificate for user access right checking. Valid values: othername, rfc822name, dnsname.
    accountKeyProcessing String
    Account key processing operation. The FortiGate will keep either the whole domain or strip the domain from the subject identity. Valid values: same, strip.
    accountingServers List<Property Map>
    Accounting-Server. The structure of accounting_server block is documented below.
    acctAllServers String
    Enable/disable sending of accounting messages to all configured servers (default = disable). Valid values: disable, enable.
    acctInterimInterval Number
    Time in seconds between each accounting interim update message.
    adom String
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    allUsergroup String
    Enable/disable automatically including this RADIUS server in all user groups. Valid values: disable, enable.
    authType String
    Authentication methods/protocols permitted for this RADIUS server. Valid values: pap, chap, ms_chap, ms_chap_v2, auto.
    caCert String
    CA of server to trust under TLS.
    callStationIdType String
    Calling & Called station identifier type configuration (default = legacy), this option is not available for 802.1x authentication. Valid values: legacy, IP, MAC.
    classes List<String>
    Class attribute name(s).
    clientCert String
    Client certificate to use under TLS.
    delimiter String
    Configure delimiter to be used for separating profile group names in the SSO attribute (default = plus character "+"). Valid values: plus, comma.
    dynamicMappings List<Property Map>
    Dynamic_Mapping. The structure of dynamic_mapping block is documented below.
    dynamicSortSubtable String
    true or false, set this parameter to true when using dynamic for_each + toset to configure and sort sub-tables, please do not set this parameter when configuring static sub-tables.
    groupOverrideAttrType String
    RADIUS attribute type to override user group information. Valid values: filter-Id, class.
    h3cCompatibility String
    Enable/disable compatibility with the H3C, a mechanism that performs security checking for authentication. Valid values: disable, enable.
    interface String
    Specify outgoing interface to reach server.
    interfaceSelectMethod String
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    macCase String
    MAC authentication case (default = lowercase). Valid values: uppercase, lowercase.
    macPasswordDelimiter String
    MAC authentication password delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    macUsernameDelimiter String
    MAC authentication username delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    name String
    RADIUS server entry name.
    nasId String
    Custom NAS identifier.
    nasIdType String
    NAS identifier type configuration (default = legacy). Valid values: legacy, custom, hostname.
    nasIp String
    IP address used to communicate with the RADIUS server and used as NAS-IP-Address and Called-Station-ID attributes.
    objectUserRadiusId String
    an identifier for the resource with format {{name}}.
    passwordEncoding String
    Password encoding. Valid values: ISO-8859-1, auto.
    passwordRenewal String
    Enable/disable password renewal. Valid values: disable, enable.
    radiusCoa String
    Enable to allow a mechanism to change the attributes of an authentication, authorization, and accounting session after it is authenticated. Valid values: disable, enable.
    radiusPort Number
    RADIUS service port number.
    rsso String
    Enable/disable RADIUS based single sign on feature. Valid values: disable, enable.
    rssoContextTimeout Number
    Time in seconds before the logged out user is removed from the "user context list" of logged on users.
    rssoEndpointAttribute String
    RADIUS attributes used to extract the user end point identifer from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rssoEndpointBlockAttribute String
    RADIUS attributes used to block a user. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rssoEpOneIpOnly String
    Enable/disable the replacement of old IP addresses with new ones for the same endpoint on RADIUS accounting Start messages. Valid values: disable, enable.
    rssoFlushIpSession String
    Enable/disable flushing user IP sessions on RADIUS accounting Stop messages. Valid values: disable, enable.
    rssoLogFlags List<String>
    Events to log. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    rssoLogPeriod Number
    Time interval in seconds that group event log messages will be generated for dynamic profile events.
    rssoRadiusResponse String
    Enable/disable sending RADIUS response packets after receiving Start and Stop records. Valid values: disable, enable.
    rssoRadiusServerPort Number
    UDP port to listen on for RADIUS Start and Stop records.
    rssoSecrets List<String>
    RADIUS secret used by the RADIUS accounting server.
    rssoValidateRequestSecret String
    Enable/disable validating the RADIUS request shared secret in the Start or End record. Valid values: disable, enable.
    scopetype String
    The scope of application of the resource. Valid values: inherit, adom, global. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    secondarySecrets List<String>
    Secret key to access the secondary server.
    secondaryServer String
    {<name_str|ip_str>} secondary RADIUS CN domain name or IP.
    secrets List<String>
    Pre-shared secret key used to access the primary RADIUS server.
    server String
    Primary RADIUS server CN domain name or IP address.
    serverIdentityCheck String
    Enable/disable RADIUS server identity check (verify server domain name/IP address against the server certificate). Valid values: disable, enable.
    sourceIp String
    Source IP address for communications to the RADIUS server.
    sourceIpInterfaces List<String>
    Source interface for communication with the RADIUS server.
    ssoAttribute String
    RADIUS attribute that contains the profile group name to be extracted from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    ssoAttributeKey String
    Key prefix for SSO group value in the SSO attribute.
    ssoAttributeValueOverride String
    Enable/disable override old attribute value with new value for the same endpoint. Valid values: disable, enable.
    statusTtl Number
    Time for which server reachability is cached so that when a server is unreachable, it will not be retried for at least this period of time (0 = cache disabled, default = 300).
    switchControllerAcctFastFramedipDetect Number
    Switch controller accounting message Framed-IP detection from DHCP snooping (seconds, default=2).
    switchControllerNasIpDynamic String
    Enable/Disable switch-controller nas-ip dynamic to dynamically set nas-ip. Valid values: disable, enable.
    switchControllerServiceTypes List<String>
    RADIUS service type. Valid values: login, framed, callback-login, callback-framed, outbound, administrative, nas-prompt, authenticate-only, callback-nas-prompt, call-check, callback-administrative.
    tertiarySecrets List<String>
    Secret key to access the tertiary server.
    tertiaryServer String
    {<name_str|ip_str>} tertiary RADIUS CN domain name or IP.
    timeout Number
    Time in seconds between re-sending authentication requests.
    tlsMinProtoVersion String
    Minimum supported protocol version for TLS connections (default is to follow system global setting). Valid values: default, TLSv1, TLSv1-1, TLSv1-2, SSLv3.
    transportProtocol String
    Transport protocol to be used (default = udp). Valid values: udp, tcp, tls.
    useManagementVdom String
    Enable/disable using management VDOM to send requests. Valid values: disable, enable.
    usernameCaseSensitive String
    Enable/disable case sensitive user names. Valid values: disable, enable.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the ObjectUserRadius resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing ObjectUserRadius Resource

    Get an existing ObjectUserRadius resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: ObjectUserRadiusState, opts?: CustomResourceOptions): ObjectUserRadius
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        account_key_cert_field: Optional[str] = None,
        account_key_processing: Optional[str] = None,
        accounting_servers: Optional[Sequence[ObjectUserRadiusAccountingServerArgs]] = None,
        acct_all_servers: Optional[str] = None,
        acct_interim_interval: Optional[float] = None,
        adom: Optional[str] = None,
        all_usergroup: Optional[str] = None,
        auth_type: Optional[str] = None,
        ca_cert: Optional[str] = None,
        call_station_id_type: Optional[str] = None,
        classes: Optional[Sequence[str]] = None,
        client_cert: Optional[str] = None,
        delimiter: Optional[str] = None,
        dynamic_mappings: Optional[Sequence[ObjectUserRadiusDynamicMappingArgs]] = None,
        dynamic_sort_subtable: Optional[str] = None,
        group_override_attr_type: Optional[str] = None,
        h3c_compatibility: Optional[str] = None,
        interface: Optional[str] = None,
        interface_select_method: Optional[str] = None,
        mac_case: Optional[str] = None,
        mac_password_delimiter: Optional[str] = None,
        mac_username_delimiter: Optional[str] = None,
        name: Optional[str] = None,
        nas_id: Optional[str] = None,
        nas_id_type: Optional[str] = None,
        nas_ip: Optional[str] = None,
        object_user_radius_id: Optional[str] = None,
        password_encoding: Optional[str] = None,
        password_renewal: Optional[str] = None,
        radius_coa: Optional[str] = None,
        radius_port: Optional[float] = None,
        rsso: Optional[str] = None,
        rsso_context_timeout: Optional[float] = None,
        rsso_endpoint_attribute: Optional[str] = None,
        rsso_endpoint_block_attribute: Optional[str] = None,
        rsso_ep_one_ip_only: Optional[str] = None,
        rsso_flush_ip_session: Optional[str] = None,
        rsso_log_flags: Optional[Sequence[str]] = None,
        rsso_log_period: Optional[float] = None,
        rsso_radius_response: Optional[str] = None,
        rsso_radius_server_port: Optional[float] = None,
        rsso_secrets: Optional[Sequence[str]] = None,
        rsso_validate_request_secret: Optional[str] = None,
        scopetype: Optional[str] = None,
        secondary_secrets: Optional[Sequence[str]] = None,
        secondary_server: Optional[str] = None,
        secrets: Optional[Sequence[str]] = None,
        server: Optional[str] = None,
        server_identity_check: Optional[str] = None,
        source_ip: Optional[str] = None,
        source_ip_interfaces: Optional[Sequence[str]] = None,
        sso_attribute: Optional[str] = None,
        sso_attribute_key: Optional[str] = None,
        sso_attribute_value_override: Optional[str] = None,
        status_ttl: Optional[float] = None,
        switch_controller_acct_fast_framedip_detect: Optional[float] = None,
        switch_controller_nas_ip_dynamic: Optional[str] = None,
        switch_controller_service_types: Optional[Sequence[str]] = None,
        tertiary_secrets: Optional[Sequence[str]] = None,
        tertiary_server: Optional[str] = None,
        timeout: Optional[float] = None,
        tls_min_proto_version: Optional[str] = None,
        transport_protocol: Optional[str] = None,
        use_management_vdom: Optional[str] = None,
        username_case_sensitive: Optional[str] = None) -> ObjectUserRadius
    func GetObjectUserRadius(ctx *Context, name string, id IDInput, state *ObjectUserRadiusState, opts ...ResourceOption) (*ObjectUserRadius, error)
    public static ObjectUserRadius Get(string name, Input<string> id, ObjectUserRadiusState? state, CustomResourceOptions? opts = null)
    public static ObjectUserRadius get(String name, Output<String> id, ObjectUserRadiusState state, CustomResourceOptions options)
    resources:  _:    type: fortimanager:ObjectUserRadius    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AccountKeyCertField string
    Define subject identity field in certificate for user access right checking. Valid values: othername, rfc822name, dnsname.
    AccountKeyProcessing string
    Account key processing operation. The FortiGate will keep either the whole domain or strip the domain from the subject identity. Valid values: same, strip.
    AccountingServers List<ObjectUserRadiusAccountingServer>
    Accounting-Server. The structure of accounting_server block is documented below.
    AcctAllServers string
    Enable/disable sending of accounting messages to all configured servers (default = disable). Valid values: disable, enable.
    AcctInterimInterval double
    Time in seconds between each accounting interim update message.
    Adom string
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    AllUsergroup string
    Enable/disable automatically including this RADIUS server in all user groups. Valid values: disable, enable.
    AuthType string
    Authentication methods/protocols permitted for this RADIUS server. Valid values: pap, chap, ms_chap, ms_chap_v2, auto.
    CaCert string
    CA of server to trust under TLS.
    CallStationIdType string
    Calling & Called station identifier type configuration (default = legacy), this option is not available for 802.1x authentication. Valid values: legacy, IP, MAC.
    Classes List<string>
    Class attribute name(s).
    ClientCert string
    Client certificate to use under TLS.
    Delimiter string
    Configure delimiter to be used for separating profile group names in the SSO attribute (default = plus character "+"). Valid values: plus, comma.
    DynamicMappings List<ObjectUserRadiusDynamicMapping>
    Dynamic_Mapping. The structure of dynamic_mapping block is documented below.
    DynamicSortSubtable string
    true or false, set this parameter to true when using dynamic for_each + toset to configure and sort sub-tables, please do not set this parameter when configuring static sub-tables.
    GroupOverrideAttrType string
    RADIUS attribute type to override user group information. Valid values: filter-Id, class.
    H3cCompatibility string
    Enable/disable compatibility with the H3C, a mechanism that performs security checking for authentication. Valid values: disable, enable.
    Interface string
    Specify outgoing interface to reach server.
    InterfaceSelectMethod string
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    MacCase string
    MAC authentication case (default = lowercase). Valid values: uppercase, lowercase.
    MacPasswordDelimiter string
    MAC authentication password delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    MacUsernameDelimiter string
    MAC authentication username delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    Name string
    RADIUS server entry name.
    NasId string
    Custom NAS identifier.
    NasIdType string
    NAS identifier type configuration (default = legacy). Valid values: legacy, custom, hostname.
    NasIp string
    IP address used to communicate with the RADIUS server and used as NAS-IP-Address and Called-Station-ID attributes.
    ObjectUserRadiusId string
    an identifier for the resource with format {{name}}.
    PasswordEncoding string
    Password encoding. Valid values: ISO-8859-1, auto.
    PasswordRenewal string
    Enable/disable password renewal. Valid values: disable, enable.
    RadiusCoa string
    Enable to allow a mechanism to change the attributes of an authentication, authorization, and accounting session after it is authenticated. Valid values: disable, enable.
    RadiusPort double
    RADIUS service port number.
    Rsso string
    Enable/disable RADIUS based single sign on feature. Valid values: disable, enable.
    RssoContextTimeout double
    Time in seconds before the logged out user is removed from the "user context list" of logged on users.
    RssoEndpointAttribute string
    RADIUS attributes used to extract the user end point identifer from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    RssoEndpointBlockAttribute string
    RADIUS attributes used to block a user. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    RssoEpOneIpOnly string
    Enable/disable the replacement of old IP addresses with new ones for the same endpoint on RADIUS accounting Start messages. Valid values: disable, enable.
    RssoFlushIpSession string
    Enable/disable flushing user IP sessions on RADIUS accounting Stop messages. Valid values: disable, enable.
    RssoLogFlags List<string>
    Events to log. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    RssoLogPeriod double
    Time interval in seconds that group event log messages will be generated for dynamic profile events.
    RssoRadiusResponse string
    Enable/disable sending RADIUS response packets after receiving Start and Stop records. Valid values: disable, enable.
    RssoRadiusServerPort double
    UDP port to listen on for RADIUS Start and Stop records.
    RssoSecrets List<string>
    RADIUS secret used by the RADIUS accounting server.
    RssoValidateRequestSecret string
    Enable/disable validating the RADIUS request shared secret in the Start or End record. Valid values: disable, enable.
    Scopetype string
    The scope of application of the resource. Valid values: inherit, adom, global. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    SecondarySecrets List<string>
    Secret key to access the secondary server.
    SecondaryServer string
    {<name_str|ip_str>} secondary RADIUS CN domain name or IP.
    Secrets List<string>
    Pre-shared secret key used to access the primary RADIUS server.
    Server string
    Primary RADIUS server CN domain name or IP address.
    ServerIdentityCheck string
    Enable/disable RADIUS server identity check (verify server domain name/IP address against the server certificate). Valid values: disable, enable.
    SourceIp string
    Source IP address for communications to the RADIUS server.
    SourceIpInterfaces List<string>
    Source interface for communication with the RADIUS server.
    SsoAttribute string
    RADIUS attribute that contains the profile group name to be extracted from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    SsoAttributeKey string
    Key prefix for SSO group value in the SSO attribute.
    SsoAttributeValueOverride string
    Enable/disable override old attribute value with new value for the same endpoint. Valid values: disable, enable.
    StatusTtl double
    Time for which server reachability is cached so that when a server is unreachable, it will not be retried for at least this period of time (0 = cache disabled, default = 300).
    SwitchControllerAcctFastFramedipDetect double
    Switch controller accounting message Framed-IP detection from DHCP snooping (seconds, default=2).
    SwitchControllerNasIpDynamic string
    Enable/Disable switch-controller nas-ip dynamic to dynamically set nas-ip. Valid values: disable, enable.
    SwitchControllerServiceTypes List<string>
    RADIUS service type. Valid values: login, framed, callback-login, callback-framed, outbound, administrative, nas-prompt, authenticate-only, callback-nas-prompt, call-check, callback-administrative.
    TertiarySecrets List<string>
    Secret key to access the tertiary server.
    TertiaryServer string
    {<name_str|ip_str>} tertiary RADIUS CN domain name or IP.
    Timeout double
    Time in seconds between re-sending authentication requests.
    TlsMinProtoVersion string
    Minimum supported protocol version for TLS connections (default is to follow system global setting). Valid values: default, TLSv1, TLSv1-1, TLSv1-2, SSLv3.
    TransportProtocol string
    Transport protocol to be used (default = udp). Valid values: udp, tcp, tls.
    UseManagementVdom string
    Enable/disable using management VDOM to send requests. Valid values: disable, enable.
    UsernameCaseSensitive string
    Enable/disable case sensitive user names. Valid values: disable, enable.
    AccountKeyCertField string
    Define subject identity field in certificate for user access right checking. Valid values: othername, rfc822name, dnsname.
    AccountKeyProcessing string
    Account key processing operation. The FortiGate will keep either the whole domain or strip the domain from the subject identity. Valid values: same, strip.
    AccountingServers []ObjectUserRadiusAccountingServerTypeArgs
    Accounting-Server. The structure of accounting_server block is documented below.
    AcctAllServers string
    Enable/disable sending of accounting messages to all configured servers (default = disable). Valid values: disable, enable.
    AcctInterimInterval float64
    Time in seconds between each accounting interim update message.
    Adom string
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    AllUsergroup string
    Enable/disable automatically including this RADIUS server in all user groups. Valid values: disable, enable.
    AuthType string
    Authentication methods/protocols permitted for this RADIUS server. Valid values: pap, chap, ms_chap, ms_chap_v2, auto.
    CaCert string
    CA of server to trust under TLS.
    CallStationIdType string
    Calling & Called station identifier type configuration (default = legacy), this option is not available for 802.1x authentication. Valid values: legacy, IP, MAC.
    Classes []string
    Class attribute name(s).
    ClientCert string
    Client certificate to use under TLS.
    Delimiter string
    Configure delimiter to be used for separating profile group names in the SSO attribute (default = plus character "+"). Valid values: plus, comma.
    DynamicMappings []ObjectUserRadiusDynamicMappingTypeArgs
    Dynamic_Mapping. The structure of dynamic_mapping block is documented below.
    DynamicSortSubtable string
    true or false, set this parameter to true when using dynamic for_each + toset to configure and sort sub-tables, please do not set this parameter when configuring static sub-tables.
    GroupOverrideAttrType string
    RADIUS attribute type to override user group information. Valid values: filter-Id, class.
    H3cCompatibility string
    Enable/disable compatibility with the H3C, a mechanism that performs security checking for authentication. Valid values: disable, enable.
    Interface string
    Specify outgoing interface to reach server.
    InterfaceSelectMethod string
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    MacCase string
    MAC authentication case (default = lowercase). Valid values: uppercase, lowercase.
    MacPasswordDelimiter string
    MAC authentication password delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    MacUsernameDelimiter string
    MAC authentication username delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    Name string
    RADIUS server entry name.
    NasId string
    Custom NAS identifier.
    NasIdType string
    NAS identifier type configuration (default = legacy). Valid values: legacy, custom, hostname.
    NasIp string
    IP address used to communicate with the RADIUS server and used as NAS-IP-Address and Called-Station-ID attributes.
    ObjectUserRadiusId string
    an identifier for the resource with format {{name}}.
    PasswordEncoding string
    Password encoding. Valid values: ISO-8859-1, auto.
    PasswordRenewal string
    Enable/disable password renewal. Valid values: disable, enable.
    RadiusCoa string
    Enable to allow a mechanism to change the attributes of an authentication, authorization, and accounting session after it is authenticated. Valid values: disable, enable.
    RadiusPort float64
    RADIUS service port number.
    Rsso string
    Enable/disable RADIUS based single sign on feature. Valid values: disable, enable.
    RssoContextTimeout float64
    Time in seconds before the logged out user is removed from the "user context list" of logged on users.
    RssoEndpointAttribute string
    RADIUS attributes used to extract the user end point identifer from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    RssoEndpointBlockAttribute string
    RADIUS attributes used to block a user. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    RssoEpOneIpOnly string
    Enable/disable the replacement of old IP addresses with new ones for the same endpoint on RADIUS accounting Start messages. Valid values: disable, enable.
    RssoFlushIpSession string
    Enable/disable flushing user IP sessions on RADIUS accounting Stop messages. Valid values: disable, enable.
    RssoLogFlags []string
    Events to log. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    RssoLogPeriod float64
    Time interval in seconds that group event log messages will be generated for dynamic profile events.
    RssoRadiusResponse string
    Enable/disable sending RADIUS response packets after receiving Start and Stop records. Valid values: disable, enable.
    RssoRadiusServerPort float64
    UDP port to listen on for RADIUS Start and Stop records.
    RssoSecrets []string
    RADIUS secret used by the RADIUS accounting server.
    RssoValidateRequestSecret string
    Enable/disable validating the RADIUS request shared secret in the Start or End record. Valid values: disable, enable.
    Scopetype string
    The scope of application of the resource. Valid values: inherit, adom, global. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    SecondarySecrets []string
    Secret key to access the secondary server.
    SecondaryServer string
    {<name_str|ip_str>} secondary RADIUS CN domain name or IP.
    Secrets []string
    Pre-shared secret key used to access the primary RADIUS server.
    Server string
    Primary RADIUS server CN domain name or IP address.
    ServerIdentityCheck string
    Enable/disable RADIUS server identity check (verify server domain name/IP address against the server certificate). Valid values: disable, enable.
    SourceIp string
    Source IP address for communications to the RADIUS server.
    SourceIpInterfaces []string
    Source interface for communication with the RADIUS server.
    SsoAttribute string
    RADIUS attribute that contains the profile group name to be extracted from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    SsoAttributeKey string
    Key prefix for SSO group value in the SSO attribute.
    SsoAttributeValueOverride string
    Enable/disable override old attribute value with new value for the same endpoint. Valid values: disable, enable.
    StatusTtl float64
    Time for which server reachability is cached so that when a server is unreachable, it will not be retried for at least this period of time (0 = cache disabled, default = 300).
    SwitchControllerAcctFastFramedipDetect float64
    Switch controller accounting message Framed-IP detection from DHCP snooping (seconds, default=2).
    SwitchControllerNasIpDynamic string
    Enable/Disable switch-controller nas-ip dynamic to dynamically set nas-ip. Valid values: disable, enable.
    SwitchControllerServiceTypes []string
    RADIUS service type. Valid values: login, framed, callback-login, callback-framed, outbound, administrative, nas-prompt, authenticate-only, callback-nas-prompt, call-check, callback-administrative.
    TertiarySecrets []string
    Secret key to access the tertiary server.
    TertiaryServer string
    {<name_str|ip_str>} tertiary RADIUS CN domain name or IP.
    Timeout float64
    Time in seconds between re-sending authentication requests.
    TlsMinProtoVersion string
    Minimum supported protocol version for TLS connections (default is to follow system global setting). Valid values: default, TLSv1, TLSv1-1, TLSv1-2, SSLv3.
    TransportProtocol string
    Transport protocol to be used (default = udp). Valid values: udp, tcp, tls.
    UseManagementVdom string
    Enable/disable using management VDOM to send requests. Valid values: disable, enable.
    UsernameCaseSensitive string
    Enable/disable case sensitive user names. Valid values: disable, enable.
    accountKeyCertField String
    Define subject identity field in certificate for user access right checking. Valid values: othername, rfc822name, dnsname.
    accountKeyProcessing String
    Account key processing operation. The FortiGate will keep either the whole domain or strip the domain from the subject identity. Valid values: same, strip.
    accountingServers List<ObjectUserRadiusAccountingServer>
    Accounting-Server. The structure of accounting_server block is documented below.
    acctAllServers String
    Enable/disable sending of accounting messages to all configured servers (default = disable). Valid values: disable, enable.
    acctInterimInterval Double
    Time in seconds between each accounting interim update message.
    adom String
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    allUsergroup String
    Enable/disable automatically including this RADIUS server in all user groups. Valid values: disable, enable.
    authType String
    Authentication methods/protocols permitted for this RADIUS server. Valid values: pap, chap, ms_chap, ms_chap_v2, auto.
    caCert String
    CA of server to trust under TLS.
    callStationIdType String
    Calling & Called station identifier type configuration (default = legacy), this option is not available for 802.1x authentication. Valid values: legacy, IP, MAC.
    classes List<String>
    Class attribute name(s).
    clientCert String
    Client certificate to use under TLS.
    delimiter String
    Configure delimiter to be used for separating profile group names in the SSO attribute (default = plus character "+"). Valid values: plus, comma.
    dynamicMappings List<ObjectUserRadiusDynamicMapping>
    Dynamic_Mapping. The structure of dynamic_mapping block is documented below.
    dynamicSortSubtable String
    true or false, set this parameter to true when using dynamic for_each + toset to configure and sort sub-tables, please do not set this parameter when configuring static sub-tables.
    groupOverrideAttrType String
    RADIUS attribute type to override user group information. Valid values: filter-Id, class.
    h3cCompatibility String
    Enable/disable compatibility with the H3C, a mechanism that performs security checking for authentication. Valid values: disable, enable.
    interfaceSelectMethod String
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    interface_ String
    Specify outgoing interface to reach server.
    macCase String
    MAC authentication case (default = lowercase). Valid values: uppercase, lowercase.
    macPasswordDelimiter String
    MAC authentication password delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    macUsernameDelimiter String
    MAC authentication username delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    name String
    RADIUS server entry name.
    nasId String
    Custom NAS identifier.
    nasIdType String
    NAS identifier type configuration (default = legacy). Valid values: legacy, custom, hostname.
    nasIp String
    IP address used to communicate with the RADIUS server and used as NAS-IP-Address and Called-Station-ID attributes.
    objectUserRadiusId String
    an identifier for the resource with format {{name}}.
    passwordEncoding String
    Password encoding. Valid values: ISO-8859-1, auto.
    passwordRenewal String
    Enable/disable password renewal. Valid values: disable, enable.
    radiusCoa String
    Enable to allow a mechanism to change the attributes of an authentication, authorization, and accounting session after it is authenticated. Valid values: disable, enable.
    radiusPort Double
    RADIUS service port number.
    rsso String
    Enable/disable RADIUS based single sign on feature. Valid values: disable, enable.
    rssoContextTimeout Double
    Time in seconds before the logged out user is removed from the "user context list" of logged on users.
    rssoEndpointAttribute String
    RADIUS attributes used to extract the user end point identifer from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rssoEndpointBlockAttribute String
    RADIUS attributes used to block a user. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rssoEpOneIpOnly String
    Enable/disable the replacement of old IP addresses with new ones for the same endpoint on RADIUS accounting Start messages. Valid values: disable, enable.
    rssoFlushIpSession String
    Enable/disable flushing user IP sessions on RADIUS accounting Stop messages. Valid values: disable, enable.
    rssoLogFlags List<String>
    Events to log. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    rssoLogPeriod Double
    Time interval in seconds that group event log messages will be generated for dynamic profile events.
    rssoRadiusResponse String
    Enable/disable sending RADIUS response packets after receiving Start and Stop records. Valid values: disable, enable.
    rssoRadiusServerPort Double
    UDP port to listen on for RADIUS Start and Stop records.
    rssoSecrets List<String>
    RADIUS secret used by the RADIUS accounting server.
    rssoValidateRequestSecret String
    Enable/disable validating the RADIUS request shared secret in the Start or End record. Valid values: disable, enable.
    scopetype String
    The scope of application of the resource. Valid values: inherit, adom, global. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    secondarySecrets List<String>
    Secret key to access the secondary server.
    secondaryServer String
    {<name_str|ip_str>} secondary RADIUS CN domain name or IP.
    secrets List<String>
    Pre-shared secret key used to access the primary RADIUS server.
    server String
    Primary RADIUS server CN domain name or IP address.
    serverIdentityCheck String
    Enable/disable RADIUS server identity check (verify server domain name/IP address against the server certificate). Valid values: disable, enable.
    sourceIp String
    Source IP address for communications to the RADIUS server.
    sourceIpInterfaces List<String>
    Source interface for communication with the RADIUS server.
    ssoAttribute String
    RADIUS attribute that contains the profile group name to be extracted from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    ssoAttributeKey String
    Key prefix for SSO group value in the SSO attribute.
    ssoAttributeValueOverride String
    Enable/disable override old attribute value with new value for the same endpoint. Valid values: disable, enable.
    statusTtl Double
    Time for which server reachability is cached so that when a server is unreachable, it will not be retried for at least this period of time (0 = cache disabled, default = 300).
    switchControllerAcctFastFramedipDetect Double
    Switch controller accounting message Framed-IP detection from DHCP snooping (seconds, default=2).
    switchControllerNasIpDynamic String
    Enable/Disable switch-controller nas-ip dynamic to dynamically set nas-ip. Valid values: disable, enable.
    switchControllerServiceTypes List<String>
    RADIUS service type. Valid values: login, framed, callback-login, callback-framed, outbound, administrative, nas-prompt, authenticate-only, callback-nas-prompt, call-check, callback-administrative.
    tertiarySecrets List<String>
    Secret key to access the tertiary server.
    tertiaryServer String
    {<name_str|ip_str>} tertiary RADIUS CN domain name or IP.
    timeout Double
    Time in seconds between re-sending authentication requests.
    tlsMinProtoVersion String
    Minimum supported protocol version for TLS connections (default is to follow system global setting). Valid values: default, TLSv1, TLSv1-1, TLSv1-2, SSLv3.
    transportProtocol String
    Transport protocol to be used (default = udp). Valid values: udp, tcp, tls.
    useManagementVdom String
    Enable/disable using management VDOM to send requests. Valid values: disable, enable.
    usernameCaseSensitive String
    Enable/disable case sensitive user names. Valid values: disable, enable.
    accountKeyCertField string
    Define subject identity field in certificate for user access right checking. Valid values: othername, rfc822name, dnsname.
    accountKeyProcessing string
    Account key processing operation. The FortiGate will keep either the whole domain or strip the domain from the subject identity. Valid values: same, strip.
    accountingServers ObjectUserRadiusAccountingServer[]
    Accounting-Server. The structure of accounting_server block is documented below.
    acctAllServers string
    Enable/disable sending of accounting messages to all configured servers (default = disable). Valid values: disable, enable.
    acctInterimInterval number
    Time in seconds between each accounting interim update message.
    adom string
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    allUsergroup string
    Enable/disable automatically including this RADIUS server in all user groups. Valid values: disable, enable.
    authType string
    Authentication methods/protocols permitted for this RADIUS server. Valid values: pap, chap, ms_chap, ms_chap_v2, auto.
    caCert string
    CA of server to trust under TLS.
    callStationIdType string
    Calling & Called station identifier type configuration (default = legacy), this option is not available for 802.1x authentication. Valid values: legacy, IP, MAC.
    classes string[]
    Class attribute name(s).
    clientCert string
    Client certificate to use under TLS.
    delimiter string
    Configure delimiter to be used for separating profile group names in the SSO attribute (default = plus character "+"). Valid values: plus, comma.
    dynamicMappings ObjectUserRadiusDynamicMapping[]
    Dynamic_Mapping. The structure of dynamic_mapping block is documented below.
    dynamicSortSubtable string
    true or false, set this parameter to true when using dynamic for_each + toset to configure and sort sub-tables, please do not set this parameter when configuring static sub-tables.
    groupOverrideAttrType string
    RADIUS attribute type to override user group information. Valid values: filter-Id, class.
    h3cCompatibility string
    Enable/disable compatibility with the H3C, a mechanism that performs security checking for authentication. Valid values: disable, enable.
    interface string
    Specify outgoing interface to reach server.
    interfaceSelectMethod string
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    macCase string
    MAC authentication case (default = lowercase). Valid values: uppercase, lowercase.
    macPasswordDelimiter string
    MAC authentication password delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    macUsernameDelimiter string
    MAC authentication username delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    name string
    RADIUS server entry name.
    nasId string
    Custom NAS identifier.
    nasIdType string
    NAS identifier type configuration (default = legacy). Valid values: legacy, custom, hostname.
    nasIp string
    IP address used to communicate with the RADIUS server and used as NAS-IP-Address and Called-Station-ID attributes.
    objectUserRadiusId string
    an identifier for the resource with format {{name}}.
    passwordEncoding string
    Password encoding. Valid values: ISO-8859-1, auto.
    passwordRenewal string
    Enable/disable password renewal. Valid values: disable, enable.
    radiusCoa string
    Enable to allow a mechanism to change the attributes of an authentication, authorization, and accounting session after it is authenticated. Valid values: disable, enable.
    radiusPort number
    RADIUS service port number.
    rsso string
    Enable/disable RADIUS based single sign on feature. Valid values: disable, enable.
    rssoContextTimeout number
    Time in seconds before the logged out user is removed from the "user context list" of logged on users.
    rssoEndpointAttribute string
    RADIUS attributes used to extract the user end point identifer from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rssoEndpointBlockAttribute string
    RADIUS attributes used to block a user. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rssoEpOneIpOnly string
    Enable/disable the replacement of old IP addresses with new ones for the same endpoint on RADIUS accounting Start messages. Valid values: disable, enable.
    rssoFlushIpSession string
    Enable/disable flushing user IP sessions on RADIUS accounting Stop messages. Valid values: disable, enable.
    rssoLogFlags string[]
    Events to log. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    rssoLogPeriod number
    Time interval in seconds that group event log messages will be generated for dynamic profile events.
    rssoRadiusResponse string
    Enable/disable sending RADIUS response packets after receiving Start and Stop records. Valid values: disable, enable.
    rssoRadiusServerPort number
    UDP port to listen on for RADIUS Start and Stop records.
    rssoSecrets string[]
    RADIUS secret used by the RADIUS accounting server.
    rssoValidateRequestSecret string
    Enable/disable validating the RADIUS request shared secret in the Start or End record. Valid values: disable, enable.
    scopetype string
    The scope of application of the resource. Valid values: inherit, adom, global. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    secondarySecrets string[]
    Secret key to access the secondary server.
    secondaryServer string
    {<name_str|ip_str>} secondary RADIUS CN domain name or IP.
    secrets string[]
    Pre-shared secret key used to access the primary RADIUS server.
    server string
    Primary RADIUS server CN domain name or IP address.
    serverIdentityCheck string
    Enable/disable RADIUS server identity check (verify server domain name/IP address against the server certificate). Valid values: disable, enable.
    sourceIp string
    Source IP address for communications to the RADIUS server.
    sourceIpInterfaces string[]
    Source interface for communication with the RADIUS server.
    ssoAttribute string
    RADIUS attribute that contains the profile group name to be extracted from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    ssoAttributeKey string
    Key prefix for SSO group value in the SSO attribute.
    ssoAttributeValueOverride string
    Enable/disable override old attribute value with new value for the same endpoint. Valid values: disable, enable.
    statusTtl number
    Time for which server reachability is cached so that when a server is unreachable, it will not be retried for at least this period of time (0 = cache disabled, default = 300).
    switchControllerAcctFastFramedipDetect number
    Switch controller accounting message Framed-IP detection from DHCP snooping (seconds, default=2).
    switchControllerNasIpDynamic string
    Enable/Disable switch-controller nas-ip dynamic to dynamically set nas-ip. Valid values: disable, enable.
    switchControllerServiceTypes string[]
    RADIUS service type. Valid values: login, framed, callback-login, callback-framed, outbound, administrative, nas-prompt, authenticate-only, callback-nas-prompt, call-check, callback-administrative.
    tertiarySecrets string[]
    Secret key to access the tertiary server.
    tertiaryServer string
    {<name_str|ip_str>} tertiary RADIUS CN domain name or IP.
    timeout number
    Time in seconds between re-sending authentication requests.
    tlsMinProtoVersion string
    Minimum supported protocol version for TLS connections (default is to follow system global setting). Valid values: default, TLSv1, TLSv1-1, TLSv1-2, SSLv3.
    transportProtocol string
    Transport protocol to be used (default = udp). Valid values: udp, tcp, tls.
    useManagementVdom string
    Enable/disable using management VDOM to send requests. Valid values: disable, enable.
    usernameCaseSensitive string
    Enable/disable case sensitive user names. Valid values: disable, enable.
    account_key_cert_field str
    Define subject identity field in certificate for user access right checking. Valid values: othername, rfc822name, dnsname.
    account_key_processing str
    Account key processing operation. The FortiGate will keep either the whole domain or strip the domain from the subject identity. Valid values: same, strip.
    accounting_servers Sequence[ObjectUserRadiusAccountingServerArgs]
    Accounting-Server. The structure of accounting_server block is documented below.
    acct_all_servers str
    Enable/disable sending of accounting messages to all configured servers (default = disable). Valid values: disable, enable.
    acct_interim_interval float
    Time in seconds between each accounting interim update message.
    adom str
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    all_usergroup str
    Enable/disable automatically including this RADIUS server in all user groups. Valid values: disable, enable.
    auth_type str
    Authentication methods/protocols permitted for this RADIUS server. Valid values: pap, chap, ms_chap, ms_chap_v2, auto.
    ca_cert str
    CA of server to trust under TLS.
    call_station_id_type str
    Calling & Called station identifier type configuration (default = legacy), this option is not available for 802.1x authentication. Valid values: legacy, IP, MAC.
    classes Sequence[str]
    Class attribute name(s).
    client_cert str
    Client certificate to use under TLS.
    delimiter str
    Configure delimiter to be used for separating profile group names in the SSO attribute (default = plus character "+"). Valid values: plus, comma.
    dynamic_mappings Sequence[ObjectUserRadiusDynamicMappingArgs]
    Dynamic_Mapping. The structure of dynamic_mapping block is documented below.
    dynamic_sort_subtable str
    true or false, set this parameter to true when using dynamic for_each + toset to configure and sort sub-tables, please do not set this parameter when configuring static sub-tables.
    group_override_attr_type str
    RADIUS attribute type to override user group information. Valid values: filter-Id, class.
    h3c_compatibility str
    Enable/disable compatibility with the H3C, a mechanism that performs security checking for authentication. Valid values: disable, enable.
    interface str
    Specify outgoing interface to reach server.
    interface_select_method str
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    mac_case str
    MAC authentication case (default = lowercase). Valid values: uppercase, lowercase.
    mac_password_delimiter str
    MAC authentication password delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    mac_username_delimiter str
    MAC authentication username delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    name str
    RADIUS server entry name.
    nas_id str
    Custom NAS identifier.
    nas_id_type str
    NAS identifier type configuration (default = legacy). Valid values: legacy, custom, hostname.
    nas_ip str
    IP address used to communicate with the RADIUS server and used as NAS-IP-Address and Called-Station-ID attributes.
    object_user_radius_id str
    an identifier for the resource with format {{name}}.
    password_encoding str
    Password encoding. Valid values: ISO-8859-1, auto.
    password_renewal str
    Enable/disable password renewal. Valid values: disable, enable.
    radius_coa str
    Enable to allow a mechanism to change the attributes of an authentication, authorization, and accounting session after it is authenticated. Valid values: disable, enable.
    radius_port float
    RADIUS service port number.
    rsso str
    Enable/disable RADIUS based single sign on feature. Valid values: disable, enable.
    rsso_context_timeout float
    Time in seconds before the logged out user is removed from the "user context list" of logged on users.
    rsso_endpoint_attribute str
    RADIUS attributes used to extract the user end point identifer from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rsso_endpoint_block_attribute str
    RADIUS attributes used to block a user. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rsso_ep_one_ip_only str
    Enable/disable the replacement of old IP addresses with new ones for the same endpoint on RADIUS accounting Start messages. Valid values: disable, enable.
    rsso_flush_ip_session str
    Enable/disable flushing user IP sessions on RADIUS accounting Stop messages. Valid values: disable, enable.
    rsso_log_flags Sequence[str]
    Events to log. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    rsso_log_period float
    Time interval in seconds that group event log messages will be generated for dynamic profile events.
    rsso_radius_response str
    Enable/disable sending RADIUS response packets after receiving Start and Stop records. Valid values: disable, enable.
    rsso_radius_server_port float
    UDP port to listen on for RADIUS Start and Stop records.
    rsso_secrets Sequence[str]
    RADIUS secret used by the RADIUS accounting server.
    rsso_validate_request_secret str
    Enable/disable validating the RADIUS request shared secret in the Start or End record. Valid values: disable, enable.
    scopetype str
    The scope of application of the resource. Valid values: inherit, adom, global. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    secondary_secrets Sequence[str]
    Secret key to access the secondary server.
    secondary_server str
    {<name_str|ip_str>} secondary RADIUS CN domain name or IP.
    secrets Sequence[str]
    Pre-shared secret key used to access the primary RADIUS server.
    server str
    Primary RADIUS server CN domain name or IP address.
    server_identity_check str
    Enable/disable RADIUS server identity check (verify server domain name/IP address against the server certificate). Valid values: disable, enable.
    source_ip str
    Source IP address for communications to the RADIUS server.
    source_ip_interfaces Sequence[str]
    Source interface for communication with the RADIUS server.
    sso_attribute str
    RADIUS attribute that contains the profile group name to be extracted from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    sso_attribute_key str
    Key prefix for SSO group value in the SSO attribute.
    sso_attribute_value_override str
    Enable/disable override old attribute value with new value for the same endpoint. Valid values: disable, enable.
    status_ttl float
    Time for which server reachability is cached so that when a server is unreachable, it will not be retried for at least this period of time (0 = cache disabled, default = 300).
    switch_controller_acct_fast_framedip_detect float
    Switch controller accounting message Framed-IP detection from DHCP snooping (seconds, default=2).
    switch_controller_nas_ip_dynamic str
    Enable/Disable switch-controller nas-ip dynamic to dynamically set nas-ip. Valid values: disable, enable.
    switch_controller_service_types Sequence[str]
    RADIUS service type. Valid values: login, framed, callback-login, callback-framed, outbound, administrative, nas-prompt, authenticate-only, callback-nas-prompt, call-check, callback-administrative.
    tertiary_secrets Sequence[str]
    Secret key to access the tertiary server.
    tertiary_server str
    {<name_str|ip_str>} tertiary RADIUS CN domain name or IP.
    timeout float
    Time in seconds between re-sending authentication requests.
    tls_min_proto_version str
    Minimum supported protocol version for TLS connections (default is to follow system global setting). Valid values: default, TLSv1, TLSv1-1, TLSv1-2, SSLv3.
    transport_protocol str
    Transport protocol to be used (default = udp). Valid values: udp, tcp, tls.
    use_management_vdom str
    Enable/disable using management VDOM to send requests. Valid values: disable, enable.
    username_case_sensitive str
    Enable/disable case sensitive user names. Valid values: disable, enable.
    accountKeyCertField String
    Define subject identity field in certificate for user access right checking. Valid values: othername, rfc822name, dnsname.
    accountKeyProcessing String
    Account key processing operation. The FortiGate will keep either the whole domain or strip the domain from the subject identity. Valid values: same, strip.
    accountingServers List<Property Map>
    Accounting-Server. The structure of accounting_server block is documented below.
    acctAllServers String
    Enable/disable sending of accounting messages to all configured servers (default = disable). Valid values: disable, enable.
    acctInterimInterval Number
    Time in seconds between each accounting interim update message.
    adom String
    Adom. This value is valid only when the scopetype is adom, otherwise the value of adom in the provider will be inherited.
    allUsergroup String
    Enable/disable automatically including this RADIUS server in all user groups. Valid values: disable, enable.
    authType String
    Authentication methods/protocols permitted for this RADIUS server. Valid values: pap, chap, ms_chap, ms_chap_v2, auto.
    caCert String
    CA of server to trust under TLS.
    callStationIdType String
    Calling & Called station identifier type configuration (default = legacy), this option is not available for 802.1x authentication. Valid values: legacy, IP, MAC.
    classes List<String>
    Class attribute name(s).
    clientCert String
    Client certificate to use under TLS.
    delimiter String
    Configure delimiter to be used for separating profile group names in the SSO attribute (default = plus character "+"). Valid values: plus, comma.
    dynamicMappings List<Property Map>
    Dynamic_Mapping. The structure of dynamic_mapping block is documented below.
    dynamicSortSubtable String
    true or false, set this parameter to true when using dynamic for_each + toset to configure and sort sub-tables, please do not set this parameter when configuring static sub-tables.
    groupOverrideAttrType String
    RADIUS attribute type to override user group information. Valid values: filter-Id, class.
    h3cCompatibility String
    Enable/disable compatibility with the H3C, a mechanism that performs security checking for authentication. Valid values: disable, enable.
    interface String
    Specify outgoing interface to reach server.
    interfaceSelectMethod String
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    macCase String
    MAC authentication case (default = lowercase). Valid values: uppercase, lowercase.
    macPasswordDelimiter String
    MAC authentication password delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    macUsernameDelimiter String
    MAC authentication username delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    name String
    RADIUS server entry name.
    nasId String
    Custom NAS identifier.
    nasIdType String
    NAS identifier type configuration (default = legacy). Valid values: legacy, custom, hostname.
    nasIp String
    IP address used to communicate with the RADIUS server and used as NAS-IP-Address and Called-Station-ID attributes.
    objectUserRadiusId String
    an identifier for the resource with format {{name}}.
    passwordEncoding String
    Password encoding. Valid values: ISO-8859-1, auto.
    passwordRenewal String
    Enable/disable password renewal. Valid values: disable, enable.
    radiusCoa String
    Enable to allow a mechanism to change the attributes of an authentication, authorization, and accounting session after it is authenticated. Valid values: disable, enable.
    radiusPort Number
    RADIUS service port number.
    rsso String
    Enable/disable RADIUS based single sign on feature. Valid values: disable, enable.
    rssoContextTimeout Number
    Time in seconds before the logged out user is removed from the "user context list" of logged on users.
    rssoEndpointAttribute String
    RADIUS attributes used to extract the user end point identifer from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rssoEndpointBlockAttribute String
    RADIUS attributes used to block a user. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rssoEpOneIpOnly String
    Enable/disable the replacement of old IP addresses with new ones for the same endpoint on RADIUS accounting Start messages. Valid values: disable, enable.
    rssoFlushIpSession String
    Enable/disable flushing user IP sessions on RADIUS accounting Stop messages. Valid values: disable, enable.
    rssoLogFlags List<String>
    Events to log. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    rssoLogPeriod Number
    Time interval in seconds that group event log messages will be generated for dynamic profile events.
    rssoRadiusResponse String
    Enable/disable sending RADIUS response packets after receiving Start and Stop records. Valid values: disable, enable.
    rssoRadiusServerPort Number
    UDP port to listen on for RADIUS Start and Stop records.
    rssoSecrets List<String>
    RADIUS secret used by the RADIUS accounting server.
    rssoValidateRequestSecret String
    Enable/disable validating the RADIUS request shared secret in the Start or End record. Valid values: disable, enable.
    scopetype String
    The scope of application of the resource. Valid values: inherit, adom, global. The inherit means that the scopetype of the provider will be inherited, and adom will also be inherited. The default value is inherit.
    secondarySecrets List<String>
    Secret key to access the secondary server.
    secondaryServer String
    {<name_str|ip_str>} secondary RADIUS CN domain name or IP.
    secrets List<String>
    Pre-shared secret key used to access the primary RADIUS server.
    server String
    Primary RADIUS server CN domain name or IP address.
    serverIdentityCheck String
    Enable/disable RADIUS server identity check (verify server domain name/IP address against the server certificate). Valid values: disable, enable.
    sourceIp String
    Source IP address for communications to the RADIUS server.
    sourceIpInterfaces List<String>
    Source interface for communication with the RADIUS server.
    ssoAttribute String
    RADIUS attribute that contains the profile group name to be extracted from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    ssoAttributeKey String
    Key prefix for SSO group value in the SSO attribute.
    ssoAttributeValueOverride String
    Enable/disable override old attribute value with new value for the same endpoint. Valid values: disable, enable.
    statusTtl Number
    Time for which server reachability is cached so that when a server is unreachable, it will not be retried for at least this period of time (0 = cache disabled, default = 300).
    switchControllerAcctFastFramedipDetect Number
    Switch controller accounting message Framed-IP detection from DHCP snooping (seconds, default=2).
    switchControllerNasIpDynamic String
    Enable/Disable switch-controller nas-ip dynamic to dynamically set nas-ip. Valid values: disable, enable.
    switchControllerServiceTypes List<String>
    RADIUS service type. Valid values: login, framed, callback-login, callback-framed, outbound, administrative, nas-prompt, authenticate-only, callback-nas-prompt, call-check, callback-administrative.
    tertiarySecrets List<String>
    Secret key to access the tertiary server.
    tertiaryServer String
    {<name_str|ip_str>} tertiary RADIUS CN domain name or IP.
    timeout Number
    Time in seconds between re-sending authentication requests.
    tlsMinProtoVersion String
    Minimum supported protocol version for TLS connections (default is to follow system global setting). Valid values: default, TLSv1, TLSv1-1, TLSv1-2, SSLv3.
    transportProtocol String
    Transport protocol to be used (default = udp). Valid values: udp, tcp, tls.
    useManagementVdom String
    Enable/disable using management VDOM to send requests. Valid values: disable, enable.
    usernameCaseSensitive String
    Enable/disable case sensitive user names. Valid values: disable, enable.

    Supporting Types

    ObjectUserRadiusAccountingServer, ObjectUserRadiusAccountingServerArgs

    Id double
    ID (0 - 4294967295).
    Interface string
    Specify outgoing interface to reach server.
    InterfaceSelectMethod string
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    Port double
    RADIUS accounting port number.
    Secrets List<string>
    Secret key.
    Server string
    {<name_str|ip_str>} Server CN domain name or IP.
    SourceIp string
    Source IP address for communications to the RADIUS server.
    Status string
    Status. Valid values: disable, enable.
    Id float64
    ID (0 - 4294967295).
    Interface string
    Specify outgoing interface to reach server.
    InterfaceSelectMethod string
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    Port float64
    RADIUS accounting port number.
    Secrets []string
    Secret key.
    Server string
    {<name_str|ip_str>} Server CN domain name or IP.
    SourceIp string
    Source IP address for communications to the RADIUS server.
    Status string
    Status. Valid values: disable, enable.
    id Double
    ID (0 - 4294967295).
    interfaceSelectMethod String
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    interface_ String
    Specify outgoing interface to reach server.
    port Double
    RADIUS accounting port number.
    secrets List<String>
    Secret key.
    server String
    {<name_str|ip_str>} Server CN domain name or IP.
    sourceIp String
    Source IP address for communications to the RADIUS server.
    status String
    Status. Valid values: disable, enable.
    id number
    ID (0 - 4294967295).
    interface string
    Specify outgoing interface to reach server.
    interfaceSelectMethod string
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    port number
    RADIUS accounting port number.
    secrets string[]
    Secret key.
    server string
    {<name_str|ip_str>} Server CN domain name or IP.
    sourceIp string
    Source IP address for communications to the RADIUS server.
    status string
    Status. Valid values: disable, enable.
    id float
    ID (0 - 4294967295).
    interface str
    Specify outgoing interface to reach server.
    interface_select_method str
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    port float
    RADIUS accounting port number.
    secrets Sequence[str]
    Secret key.
    server str
    {<name_str|ip_str>} Server CN domain name or IP.
    source_ip str
    Source IP address for communications to the RADIUS server.
    status str
    Status. Valid values: disable, enable.
    id Number
    ID (0 - 4294967295).
    interface String
    Specify outgoing interface to reach server.
    interfaceSelectMethod String
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    port Number
    RADIUS accounting port number.
    secrets List<String>
    Secret key.
    server String
    {<name_str|ip_str>} Server CN domain name or IP.
    sourceIp String
    Source IP address for communications to the RADIUS server.
    status String
    Status. Valid values: disable, enable.

    ObjectUserRadiusDynamicMapping, ObjectUserRadiusDynamicMappingArgs

    AccountKeyCertField string
    Define subject identity field in certificate for user access right checking. Valid values: othername, rfc822name, dnsname.
    AccountKeyProcessing string
    Account key processing operation. The FortiGate will keep either the whole domain or strip the domain from the subject identity. Valid values: same, strip.
    AccountingServers List<ObjectUserRadiusDynamicMappingAccountingServer>
    Accounting-Server. The structure of accounting_server block is documented below.
    AcctAllServers string
    Enable/disable sending of accounting messages to all configured servers (default = disable). Valid values: disable, enable.
    AcctInterimInterval double
    Time in seconds between each accounting interim update message.
    AllUsergroup string
    Enable/disable automatically including this RADIUS server in all user groups. Valid values: disable, enable.
    AuthType string
    Authentication methods/protocols permitted for this RADIUS server. Valid values: pap, chap, ms_chap, ms_chap_v2, auto.
    CaCert string
    CA of server to trust under TLS.
    CallStationIdType string
    Calling & Called station identifier type configuration (default = legacy), this option is not available for 802.1x authentication. Valid values: legacy, IP, MAC.
    Classes List<string>
    Class attribute name(s).
    ClientCert string
    Client certificate to use under TLS.
    Delimiter string
    Delimiter. Valid values: plus, comma.
    DpCarrierEndpointAttribute string
    Dp-Carrier-Endpoint-Attribute. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Vendor-Specific, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    DpCarrierEndpointBlockAttribute string
    Dp-Carrier-Endpoint-Block-Attribute. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Vendor-Specific, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    DpContextTimeout double
    Dp-Context-Timeout.
    DpFlushIpSession string
    Dp-Flush-Ip-Session. Valid values: disable, enable.
    DpHoldTime double
    Dp-Hold-Time.
    DpHttpHeader string
    Dp-Http-Header.
    DpHttpHeaderFallback string
    Dp-Http-Header-Fallback. Valid values: ip-header-address, default-profile.
    DpHttpHeaderStatus string
    Dp-Http-Header-Status. Valid values: disable, enable.
    DpHttpHeaderSuppress string
    Dp-Http-Header-Suppress. Valid values: disable, enable.
    DpLogDynFlags List<string>
    Dp-Log-Dyn_Flags. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    DpLogPeriod double
    Dp-Log-Period.
    DpMemPercent double
    Dp-Mem-Percent.
    DpProfileAttribute string
    Dp-Profile-Attribute. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Vendor-Specific, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    DpProfileAttributeKey string
    Dp-Profile-Attribute-Key.
    DpRadiusResponse string
    Dp-Radius-Response. Valid values: disable, enable.
    DpRadiusServerPort double
    Dp-Radius-Server-Port.
    DpSecrets List<string>
    Dp-Secret.
    DpValidateRequestSecret string
    Dp-Validate-Request-Secret. Valid values: disable, enable.
    DynamicProfile string
    Dynamic-Profile. Valid values: disable, enable.
    EndpointTranslation string
    Endpoint-Translation. Valid values: disable, enable.
    EpCarrierEndpointConvertHex string
    Ep-Carrier-Endpoint-Convert-Hex. Valid values: disable, enable.
    EpCarrierEndpointHeader string
    Ep-Carrier-Endpoint-Header.
    EpCarrierEndpointHeaderSuppress string
    Ep-Carrier-Endpoint-Header-Suppress. Valid values: disable, enable.
    EpCarrierEndpointPrefix string
    Ep-Carrier-Endpoint-Prefix. Valid values: disable, enable.
    EpCarrierEndpointPrefixRangeMax double
    Ep-Carrier-Endpoint-Prefix-Range-Max.
    EpCarrierEndpointPrefixRangeMin double
    Ep-Carrier-Endpoint-Prefix-Range-Min.
    EpCarrierEndpointPrefixString string
    Ep-Carrier-Endpoint-Prefix-String.
    EpCarrierEndpointSource string
    Ep-Carrier-Endpoint-Source. Valid values: http-header, cookie.
    EpIpHeader string
    Ep-Ip-Header.
    EpIpHeaderSuppress string
    Ep-Ip-Header-Suppress. Valid values: disable, enable.
    EpMissingHeaderFallback string
    Ep-Missing-Header-Fallback. Valid values: session-ip, policy-profile.
    EpProfileQueryType string
    Ep-Profile-Query-Type. Valid values: session-ip, extract-ip, extract-carrier-endpoint.
    GroupOverrideAttrType string
    Group-Override-Attr-Type. Valid values: filter-Id, class.
    H3cCompatibility string
    Enable/disable compatibility with the H3C, a mechanism that performs security checking for authentication. Valid values: disable, enable.
    Interface string
    Specify outgoing interface to reach server.
    InterfaceSelectMethod string
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    MacCase string
    MAC authentication case (default = lowercase). Valid values: uppercase, lowercase.
    MacPasswordDelimiter string
    MAC authentication password delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    MacUsernameDelimiter string
    MAC authentication username delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    NasId string
    Custom NAS identifier.
    NasIdType string
    NAS identifier type configuration (default = legacy). Valid values: legacy, custom, hostname.
    NasIp string
    IP address used to communicate with the RADIUS server and used as NAS-IP-Address and Called-Station-ID attributes.
    PasswordEncoding string
    Password encoding. Valid values: ISO-8859-1, auto.
    PasswordRenewal string
    Enable/disable password renewal. Valid values: disable, enable.
    RadiusCoa string
    Enable to allow a mechanism to change the attributes of an authentication, authorization, and accounting session after it is authenticated. Valid values: disable, enable.
    RadiusPort double
    RADIUS service port number.
    Rsso string
    Enable/disable RADIUS based single sign on feature. Valid values: disable, enable.
    RssoContextTimeout double
    Time in seconds before the logged out user is removed from the "user context list" of logged on users.
    RssoEndpointAttribute string
    RADIUS attributes used to extract the user end point identifer from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    RssoEndpointBlockAttribute string
    RADIUS attributes used to block a user. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    RssoEpOneIpOnly string
    Enable/disable the replacement of old IP addresses with new ones for the same endpoint on RADIUS accounting Start messages. Valid values: disable, enable.
    RssoFlushIpSession string
    Enable/disable flushing user IP sessions on RADIUS accounting Stop messages. Valid values: disable, enable.
    RssoLogFlags List<string>
    Events to log. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    RssoLogPeriod double
    Time interval in seconds that group event log messages will be generated for dynamic profile events.
    RssoRadiusResponse string
    Enable/disable sending RADIUS response packets after receiving Start and Stop records. Valid values: disable, enable.
    RssoRadiusServerPort double
    UDP port to listen on for RADIUS Start and Stop records.
    RssoSecrets List<string>
    RADIUS secret used by the RADIUS accounting server.
    RssoValidateRequestSecret string
    Enable/disable validating the RADIUS request shared secret in the Start or End record. Valid values: disable, enable.
    SecondarySecrets List<string>
    Secret key to access the secondary server.
    SecondaryServer string
    {<name_str|ip_str>} secondary RADIUS CN domain name or IP.
    Secrets List<string>
    Pre-shared secret key used to access the primary RADIUS server.
    Server string
    Primary RADIUS server CN domain name or IP address.
    ServerIdentityCheck string
    Enable/disable RADIUS server identity check (verify server domain name/IP address against the server certificate). Valid values: disable, enable.
    SourceIp string
    Source IP address for communications to the RADIUS server.
    SourceIpInterfaces List<string>
    Source interface for communication with the RADIUS server.
    SsoAttribute string
    RADIUS attribute that contains the profile group name to be extracted from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    SsoAttributeKey string
    Key prefix for SSO group value in the SSO attribute.
    SsoAttributeValueOverride string
    Enable/disable override old attribute value with new value for the same endpoint. Valid values: disable, enable.
    StatusTtl double
    Time for which server reachability is cached so that when a server is unreachable, it will not be retried for at least this period of time (0 = cache disabled, default = 300).
    SwitchControllerAcctFastFramedipDetect double
    Switch-Controller-Acct-Fast-Framedip-Detect.
    SwitchControllerNasIpDynamic string
    Enable/Disable switch-controller nas-ip dynamic to dynamically set nas-ip. Valid values: disable, enable.
    SwitchControllerServiceTypes List<string>
    Switch-Controller-Service-Type. Valid values: login, framed, callback-login, callback-framed, outbound, administrative, nas-prompt, authenticate-only, callback-nas-prompt, call-check, callback-administrative.
    TertiarySecrets List<string>
    Secret key to access the tertiary server.
    TertiaryServer string
    {<name_str|ip_str>} tertiary RADIUS CN domain name or IP.
    Timeout double
    Time in seconds between re-sending authentication requests.
    TlsMinProtoVersion string
    Minimum supported protocol version for TLS connections (default is to follow system global setting). Valid values: default, TLSv1, TLSv1-1, TLSv1-2, SSLv3.
    TransportProtocol string
    Transport protocol to be used (default = udp). Valid values: udp, tcp, tls.
    UseGroupForProfile string
    Use-Group-For-Profile. Valid values: disable, enable.
    UseManagementVdom string
    Enable/disable using management VDOM to send requests. Valid values: disable, enable.
    UsernameCaseSensitive string
    Enable/disable case sensitive user names. Valid values: disable, enable.
    _scopes List<ObjectUserRadiusDynamicMapping_Scope>
    _Scope. The structure of _scope block is documented below.
    AccountKeyCertField string
    Define subject identity field in certificate for user access right checking. Valid values: othername, rfc822name, dnsname.
    AccountKeyProcessing string
    Account key processing operation. The FortiGate will keep either the whole domain or strip the domain from the subject identity. Valid values: same, strip.
    AccountingServers []ObjectUserRadiusDynamicMappingAccountingServerType
    Accounting-Server. The structure of accounting_server block is documented below.
    AcctAllServers string
    Enable/disable sending of accounting messages to all configured servers (default = disable). Valid values: disable, enable.
    AcctInterimInterval float64
    Time in seconds between each accounting interim update message.
    AllUsergroup string
    Enable/disable automatically including this RADIUS server in all user groups. Valid values: disable, enable.
    AuthType string
    Authentication methods/protocols permitted for this RADIUS server. Valid values: pap, chap, ms_chap, ms_chap_v2, auto.
    CaCert string
    CA of server to trust under TLS.
    CallStationIdType string
    Calling & Called station identifier type configuration (default = legacy), this option is not available for 802.1x authentication. Valid values: legacy, IP, MAC.
    Classes []string
    Class attribute name(s).
    ClientCert string
    Client certificate to use under TLS.
    Delimiter string
    Delimiter. Valid values: plus, comma.
    DpCarrierEndpointAttribute string
    Dp-Carrier-Endpoint-Attribute. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Vendor-Specific, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    DpCarrierEndpointBlockAttribute string
    Dp-Carrier-Endpoint-Block-Attribute. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Vendor-Specific, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    DpContextTimeout float64
    Dp-Context-Timeout.
    DpFlushIpSession string
    Dp-Flush-Ip-Session. Valid values: disable, enable.
    DpHoldTime float64
    Dp-Hold-Time.
    DpHttpHeader string
    Dp-Http-Header.
    DpHttpHeaderFallback string
    Dp-Http-Header-Fallback. Valid values: ip-header-address, default-profile.
    DpHttpHeaderStatus string
    Dp-Http-Header-Status. Valid values: disable, enable.
    DpHttpHeaderSuppress string
    Dp-Http-Header-Suppress. Valid values: disable, enable.
    DpLogDynFlags []string
    Dp-Log-Dyn_Flags. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    DpLogPeriod float64
    Dp-Log-Period.
    DpMemPercent float64
    Dp-Mem-Percent.
    DpProfileAttribute string
    Dp-Profile-Attribute. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Vendor-Specific, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    DpProfileAttributeKey string
    Dp-Profile-Attribute-Key.
    DpRadiusResponse string
    Dp-Radius-Response. Valid values: disable, enable.
    DpRadiusServerPort float64
    Dp-Radius-Server-Port.
    DpSecrets []string
    Dp-Secret.
    DpValidateRequestSecret string
    Dp-Validate-Request-Secret. Valid values: disable, enable.
    DynamicProfile string
    Dynamic-Profile. Valid values: disable, enable.
    EndpointTranslation string
    Endpoint-Translation. Valid values: disable, enable.
    EpCarrierEndpointConvertHex string
    Ep-Carrier-Endpoint-Convert-Hex. Valid values: disable, enable.
    EpCarrierEndpointHeader string
    Ep-Carrier-Endpoint-Header.
    EpCarrierEndpointHeaderSuppress string
    Ep-Carrier-Endpoint-Header-Suppress. Valid values: disable, enable.
    EpCarrierEndpointPrefix string
    Ep-Carrier-Endpoint-Prefix. Valid values: disable, enable.
    EpCarrierEndpointPrefixRangeMax float64
    Ep-Carrier-Endpoint-Prefix-Range-Max.
    EpCarrierEndpointPrefixRangeMin float64
    Ep-Carrier-Endpoint-Prefix-Range-Min.
    EpCarrierEndpointPrefixString string
    Ep-Carrier-Endpoint-Prefix-String.
    EpCarrierEndpointSource string
    Ep-Carrier-Endpoint-Source. Valid values: http-header, cookie.
    EpIpHeader string
    Ep-Ip-Header.
    EpIpHeaderSuppress string
    Ep-Ip-Header-Suppress. Valid values: disable, enable.
    EpMissingHeaderFallback string
    Ep-Missing-Header-Fallback. Valid values: session-ip, policy-profile.
    EpProfileQueryType string
    Ep-Profile-Query-Type. Valid values: session-ip, extract-ip, extract-carrier-endpoint.
    GroupOverrideAttrType string
    Group-Override-Attr-Type. Valid values: filter-Id, class.
    H3cCompatibility string
    Enable/disable compatibility with the H3C, a mechanism that performs security checking for authentication. Valid values: disable, enable.
    Interface string
    Specify outgoing interface to reach server.
    InterfaceSelectMethod string
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    MacCase string
    MAC authentication case (default = lowercase). Valid values: uppercase, lowercase.
    MacPasswordDelimiter string
    MAC authentication password delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    MacUsernameDelimiter string
    MAC authentication username delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    NasId string
    Custom NAS identifier.
    NasIdType string
    NAS identifier type configuration (default = legacy). Valid values: legacy, custom, hostname.
    NasIp string
    IP address used to communicate with the RADIUS server and used as NAS-IP-Address and Called-Station-ID attributes.
    PasswordEncoding string
    Password encoding. Valid values: ISO-8859-1, auto.
    PasswordRenewal string
    Enable/disable password renewal. Valid values: disable, enable.
    RadiusCoa string
    Enable to allow a mechanism to change the attributes of an authentication, authorization, and accounting session after it is authenticated. Valid values: disable, enable.
    RadiusPort float64
    RADIUS service port number.
    Rsso string
    Enable/disable RADIUS based single sign on feature. Valid values: disable, enable.
    RssoContextTimeout float64
    Time in seconds before the logged out user is removed from the "user context list" of logged on users.
    RssoEndpointAttribute string
    RADIUS attributes used to extract the user end point identifer from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    RssoEndpointBlockAttribute string
    RADIUS attributes used to block a user. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    RssoEpOneIpOnly string
    Enable/disable the replacement of old IP addresses with new ones for the same endpoint on RADIUS accounting Start messages. Valid values: disable, enable.
    RssoFlushIpSession string
    Enable/disable flushing user IP sessions on RADIUS accounting Stop messages. Valid values: disable, enable.
    RssoLogFlags []string
    Events to log. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    RssoLogPeriod float64
    Time interval in seconds that group event log messages will be generated for dynamic profile events.
    RssoRadiusResponse string
    Enable/disable sending RADIUS response packets after receiving Start and Stop records. Valid values: disable, enable.
    RssoRadiusServerPort float64
    UDP port to listen on for RADIUS Start and Stop records.
    RssoSecrets []string
    RADIUS secret used by the RADIUS accounting server.
    RssoValidateRequestSecret string
    Enable/disable validating the RADIUS request shared secret in the Start or End record. Valid values: disable, enable.
    SecondarySecrets []string
    Secret key to access the secondary server.
    SecondaryServer string
    {<name_str|ip_str>} secondary RADIUS CN domain name or IP.
    Secrets []string
    Pre-shared secret key used to access the primary RADIUS server.
    Server string
    Primary RADIUS server CN domain name or IP address.
    ServerIdentityCheck string
    Enable/disable RADIUS server identity check (verify server domain name/IP address against the server certificate). Valid values: disable, enable.
    SourceIp string
    Source IP address for communications to the RADIUS server.
    SourceIpInterfaces []string
    Source interface for communication with the RADIUS server.
    SsoAttribute string
    RADIUS attribute that contains the profile group name to be extracted from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    SsoAttributeKey string
    Key prefix for SSO group value in the SSO attribute.
    SsoAttributeValueOverride string
    Enable/disable override old attribute value with new value for the same endpoint. Valid values: disable, enable.
    StatusTtl float64
    Time for which server reachability is cached so that when a server is unreachable, it will not be retried for at least this period of time (0 = cache disabled, default = 300).
    SwitchControllerAcctFastFramedipDetect float64
    Switch-Controller-Acct-Fast-Framedip-Detect.
    SwitchControllerNasIpDynamic string
    Enable/Disable switch-controller nas-ip dynamic to dynamically set nas-ip. Valid values: disable, enable.
    SwitchControllerServiceTypes []string
    Switch-Controller-Service-Type. Valid values: login, framed, callback-login, callback-framed, outbound, administrative, nas-prompt, authenticate-only, callback-nas-prompt, call-check, callback-administrative.
    TertiarySecrets []string
    Secret key to access the tertiary server.
    TertiaryServer string
    {<name_str|ip_str>} tertiary RADIUS CN domain name or IP.
    Timeout float64
    Time in seconds between re-sending authentication requests.
    TlsMinProtoVersion string
    Minimum supported protocol version for TLS connections (default is to follow system global setting). Valid values: default, TLSv1, TLSv1-1, TLSv1-2, SSLv3.
    TransportProtocol string
    Transport protocol to be used (default = udp). Valid values: udp, tcp, tls.
    UseGroupForProfile string
    Use-Group-For-Profile. Valid values: disable, enable.
    UseManagementVdom string
    Enable/disable using management VDOM to send requests. Valid values: disable, enable.
    UsernameCaseSensitive string
    Enable/disable case sensitive user names. Valid values: disable, enable.
    _scopes []ObjectUserRadiusDynamicMapping_Scope
    _Scope. The structure of _scope block is documented below.
    _scopes List<ObjectUserRadiusDynamicMapping_Scope>
    _Scope. The structure of _scope block is documented below.
    accountKeyCertField String
    Define subject identity field in certificate for user access right checking. Valid values: othername, rfc822name, dnsname.
    accountKeyProcessing String
    Account key processing operation. The FortiGate will keep either the whole domain or strip the domain from the subject identity. Valid values: same, strip.
    accountingServers List<ObjectUserRadiusDynamicMappingAccountingServer>
    Accounting-Server. The structure of accounting_server block is documented below.
    acctAllServers String
    Enable/disable sending of accounting messages to all configured servers (default = disable). Valid values: disable, enable.
    acctInterimInterval Double
    Time in seconds between each accounting interim update message.
    allUsergroup String
    Enable/disable automatically including this RADIUS server in all user groups. Valid values: disable, enable.
    authType String
    Authentication methods/protocols permitted for this RADIUS server. Valid values: pap, chap, ms_chap, ms_chap_v2, auto.
    caCert String
    CA of server to trust under TLS.
    callStationIdType String
    Calling & Called station identifier type configuration (default = legacy), this option is not available for 802.1x authentication. Valid values: legacy, IP, MAC.
    classes List<String>
    Class attribute name(s).
    clientCert String
    Client certificate to use under TLS.
    delimiter String
    Delimiter. Valid values: plus, comma.
    dpCarrierEndpointAttribute String
    Dp-Carrier-Endpoint-Attribute. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Vendor-Specific, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    dpCarrierEndpointBlockAttribute String
    Dp-Carrier-Endpoint-Block-Attribute. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Vendor-Specific, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    dpContextTimeout Double
    Dp-Context-Timeout.
    dpFlushIpSession String
    Dp-Flush-Ip-Session. Valid values: disable, enable.
    dpHoldTime Double
    Dp-Hold-Time.
    dpHttpHeader String
    Dp-Http-Header.
    dpHttpHeaderFallback String
    Dp-Http-Header-Fallback. Valid values: ip-header-address, default-profile.
    dpHttpHeaderStatus String
    Dp-Http-Header-Status. Valid values: disable, enable.
    dpHttpHeaderSuppress String
    Dp-Http-Header-Suppress. Valid values: disable, enable.
    dpLogDynFlags List<String>
    Dp-Log-Dyn_Flags. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    dpLogPeriod Double
    Dp-Log-Period.
    dpMemPercent Double
    Dp-Mem-Percent.
    dpProfileAttribute String
    Dp-Profile-Attribute. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Vendor-Specific, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    dpProfileAttributeKey String
    Dp-Profile-Attribute-Key.
    dpRadiusResponse String
    Dp-Radius-Response. Valid values: disable, enable.
    dpRadiusServerPort Double
    Dp-Radius-Server-Port.
    dpSecrets List<String>
    Dp-Secret.
    dpValidateRequestSecret String
    Dp-Validate-Request-Secret. Valid values: disable, enable.
    dynamicProfile String
    Dynamic-Profile. Valid values: disable, enable.
    endpointTranslation String
    Endpoint-Translation. Valid values: disable, enable.
    epCarrierEndpointConvertHex String
    Ep-Carrier-Endpoint-Convert-Hex. Valid values: disable, enable.
    epCarrierEndpointHeader String
    Ep-Carrier-Endpoint-Header.
    epCarrierEndpointHeaderSuppress String
    Ep-Carrier-Endpoint-Header-Suppress. Valid values: disable, enable.
    epCarrierEndpointPrefix String
    Ep-Carrier-Endpoint-Prefix. Valid values: disable, enable.
    epCarrierEndpointPrefixRangeMax Double
    Ep-Carrier-Endpoint-Prefix-Range-Max.
    epCarrierEndpointPrefixRangeMin Double
    Ep-Carrier-Endpoint-Prefix-Range-Min.
    epCarrierEndpointPrefixString String
    Ep-Carrier-Endpoint-Prefix-String.
    epCarrierEndpointSource String
    Ep-Carrier-Endpoint-Source. Valid values: http-header, cookie.
    epIpHeader String
    Ep-Ip-Header.
    epIpHeaderSuppress String
    Ep-Ip-Header-Suppress. Valid values: disable, enable.
    epMissingHeaderFallback String
    Ep-Missing-Header-Fallback. Valid values: session-ip, policy-profile.
    epProfileQueryType String
    Ep-Profile-Query-Type. Valid values: session-ip, extract-ip, extract-carrier-endpoint.
    groupOverrideAttrType String
    Group-Override-Attr-Type. Valid values: filter-Id, class.
    h3cCompatibility String
    Enable/disable compatibility with the H3C, a mechanism that performs security checking for authentication. Valid values: disable, enable.
    interfaceSelectMethod String
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    interface_ String
    Specify outgoing interface to reach server.
    macCase String
    MAC authentication case (default = lowercase). Valid values: uppercase, lowercase.
    macPasswordDelimiter String
    MAC authentication password delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    macUsernameDelimiter String
    MAC authentication username delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    nasId String
    Custom NAS identifier.
    nasIdType String
    NAS identifier type configuration (default = legacy). Valid values: legacy, custom, hostname.
    nasIp String
    IP address used to communicate with the RADIUS server and used as NAS-IP-Address and Called-Station-ID attributes.
    passwordEncoding String
    Password encoding. Valid values: ISO-8859-1, auto.
    passwordRenewal String
    Enable/disable password renewal. Valid values: disable, enable.
    radiusCoa String
    Enable to allow a mechanism to change the attributes of an authentication, authorization, and accounting session after it is authenticated. Valid values: disable, enable.
    radiusPort Double
    RADIUS service port number.
    rsso String
    Enable/disable RADIUS based single sign on feature. Valid values: disable, enable.
    rssoContextTimeout Double
    Time in seconds before the logged out user is removed from the "user context list" of logged on users.
    rssoEndpointAttribute String
    RADIUS attributes used to extract the user end point identifer from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rssoEndpointBlockAttribute String
    RADIUS attributes used to block a user. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rssoEpOneIpOnly String
    Enable/disable the replacement of old IP addresses with new ones for the same endpoint on RADIUS accounting Start messages. Valid values: disable, enable.
    rssoFlushIpSession String
    Enable/disable flushing user IP sessions on RADIUS accounting Stop messages. Valid values: disable, enable.
    rssoLogFlags List<String>
    Events to log. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    rssoLogPeriod Double
    Time interval in seconds that group event log messages will be generated for dynamic profile events.
    rssoRadiusResponse String
    Enable/disable sending RADIUS response packets after receiving Start and Stop records. Valid values: disable, enable.
    rssoRadiusServerPort Double
    UDP port to listen on for RADIUS Start and Stop records.
    rssoSecrets List<String>
    RADIUS secret used by the RADIUS accounting server.
    rssoValidateRequestSecret String
    Enable/disable validating the RADIUS request shared secret in the Start or End record. Valid values: disable, enable.
    secondarySecrets List<String>
    Secret key to access the secondary server.
    secondaryServer String
    {<name_str|ip_str>} secondary RADIUS CN domain name or IP.
    secrets List<String>
    Pre-shared secret key used to access the primary RADIUS server.
    server String
    Primary RADIUS server CN domain name or IP address.
    serverIdentityCheck String
    Enable/disable RADIUS server identity check (verify server domain name/IP address against the server certificate). Valid values: disable, enable.
    sourceIp String
    Source IP address for communications to the RADIUS server.
    sourceIpInterfaces List<String>
    Source interface for communication with the RADIUS server.
    ssoAttribute String
    RADIUS attribute that contains the profile group name to be extracted from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    ssoAttributeKey String
    Key prefix for SSO group value in the SSO attribute.
    ssoAttributeValueOverride String
    Enable/disable override old attribute value with new value for the same endpoint. Valid values: disable, enable.
    statusTtl Double
    Time for which server reachability is cached so that when a server is unreachable, it will not be retried for at least this period of time (0 = cache disabled, default = 300).
    switchControllerAcctFastFramedipDetect Double
    Switch-Controller-Acct-Fast-Framedip-Detect.
    switchControllerNasIpDynamic String
    Enable/Disable switch-controller nas-ip dynamic to dynamically set nas-ip. Valid values: disable, enable.
    switchControllerServiceTypes List<String>
    Switch-Controller-Service-Type. Valid values: login, framed, callback-login, callback-framed, outbound, administrative, nas-prompt, authenticate-only, callback-nas-prompt, call-check, callback-administrative.
    tertiarySecrets List<String>
    Secret key to access the tertiary server.
    tertiaryServer String
    {<name_str|ip_str>} tertiary RADIUS CN domain name or IP.
    timeout Double
    Time in seconds between re-sending authentication requests.
    tlsMinProtoVersion String
    Minimum supported protocol version for TLS connections (default is to follow system global setting). Valid values: default, TLSv1, TLSv1-1, TLSv1-2, SSLv3.
    transportProtocol String
    Transport protocol to be used (default = udp). Valid values: udp, tcp, tls.
    useGroupForProfile String
    Use-Group-For-Profile. Valid values: disable, enable.
    useManagementVdom String
    Enable/disable using management VDOM to send requests. Valid values: disable, enable.
    usernameCaseSensitive String
    Enable/disable case sensitive user names. Valid values: disable, enable.
    _scopes ObjectUserRadiusDynamicMapping_Scope[]
    _Scope. The structure of _scope block is documented below.
    accountKeyCertField string
    Define subject identity field in certificate for user access right checking. Valid values: othername, rfc822name, dnsname.
    accountKeyProcessing string
    Account key processing operation. The FortiGate will keep either the whole domain or strip the domain from the subject identity. Valid values: same, strip.
    accountingServers ObjectUserRadiusDynamicMappingAccountingServer[]
    Accounting-Server. The structure of accounting_server block is documented below.
    acctAllServers string
    Enable/disable sending of accounting messages to all configured servers (default = disable). Valid values: disable, enable.
    acctInterimInterval number
    Time in seconds between each accounting interim update message.
    allUsergroup string
    Enable/disable automatically including this RADIUS server in all user groups. Valid values: disable, enable.
    authType string
    Authentication methods/protocols permitted for this RADIUS server. Valid values: pap, chap, ms_chap, ms_chap_v2, auto.
    caCert string
    CA of server to trust under TLS.
    callStationIdType string
    Calling & Called station identifier type configuration (default = legacy), this option is not available for 802.1x authentication. Valid values: legacy, IP, MAC.
    classes string[]
    Class attribute name(s).
    clientCert string
    Client certificate to use under TLS.
    delimiter string
    Delimiter. Valid values: plus, comma.
    dpCarrierEndpointAttribute string
    Dp-Carrier-Endpoint-Attribute. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Vendor-Specific, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    dpCarrierEndpointBlockAttribute string
    Dp-Carrier-Endpoint-Block-Attribute. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Vendor-Specific, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    dpContextTimeout number
    Dp-Context-Timeout.
    dpFlushIpSession string
    Dp-Flush-Ip-Session. Valid values: disable, enable.
    dpHoldTime number
    Dp-Hold-Time.
    dpHttpHeader string
    Dp-Http-Header.
    dpHttpHeaderFallback string
    Dp-Http-Header-Fallback. Valid values: ip-header-address, default-profile.
    dpHttpHeaderStatus string
    Dp-Http-Header-Status. Valid values: disable, enable.
    dpHttpHeaderSuppress string
    Dp-Http-Header-Suppress. Valid values: disable, enable.
    dpLogDynFlags string[]
    Dp-Log-Dyn_Flags. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    dpLogPeriod number
    Dp-Log-Period.
    dpMemPercent number
    Dp-Mem-Percent.
    dpProfileAttribute string
    Dp-Profile-Attribute. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Vendor-Specific, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    dpProfileAttributeKey string
    Dp-Profile-Attribute-Key.
    dpRadiusResponse string
    Dp-Radius-Response. Valid values: disable, enable.
    dpRadiusServerPort number
    Dp-Radius-Server-Port.
    dpSecrets string[]
    Dp-Secret.
    dpValidateRequestSecret string
    Dp-Validate-Request-Secret. Valid values: disable, enable.
    dynamicProfile string
    Dynamic-Profile. Valid values: disable, enable.
    endpointTranslation string
    Endpoint-Translation. Valid values: disable, enable.
    epCarrierEndpointConvertHex string
    Ep-Carrier-Endpoint-Convert-Hex. Valid values: disable, enable.
    epCarrierEndpointHeader string
    Ep-Carrier-Endpoint-Header.
    epCarrierEndpointHeaderSuppress string
    Ep-Carrier-Endpoint-Header-Suppress. Valid values: disable, enable.
    epCarrierEndpointPrefix string
    Ep-Carrier-Endpoint-Prefix. Valid values: disable, enable.
    epCarrierEndpointPrefixRangeMax number
    Ep-Carrier-Endpoint-Prefix-Range-Max.
    epCarrierEndpointPrefixRangeMin number
    Ep-Carrier-Endpoint-Prefix-Range-Min.
    epCarrierEndpointPrefixString string
    Ep-Carrier-Endpoint-Prefix-String.
    epCarrierEndpointSource string
    Ep-Carrier-Endpoint-Source. Valid values: http-header, cookie.
    epIpHeader string
    Ep-Ip-Header.
    epIpHeaderSuppress string
    Ep-Ip-Header-Suppress. Valid values: disable, enable.
    epMissingHeaderFallback string
    Ep-Missing-Header-Fallback. Valid values: session-ip, policy-profile.
    epProfileQueryType string
    Ep-Profile-Query-Type. Valid values: session-ip, extract-ip, extract-carrier-endpoint.
    groupOverrideAttrType string
    Group-Override-Attr-Type. Valid values: filter-Id, class.
    h3cCompatibility string
    Enable/disable compatibility with the H3C, a mechanism that performs security checking for authentication. Valid values: disable, enable.
    interface string
    Specify outgoing interface to reach server.
    interfaceSelectMethod string
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    macCase string
    MAC authentication case (default = lowercase). Valid values: uppercase, lowercase.
    macPasswordDelimiter string
    MAC authentication password delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    macUsernameDelimiter string
    MAC authentication username delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    nasId string
    Custom NAS identifier.
    nasIdType string
    NAS identifier type configuration (default = legacy). Valid values: legacy, custom, hostname.
    nasIp string
    IP address used to communicate with the RADIUS server and used as NAS-IP-Address and Called-Station-ID attributes.
    passwordEncoding string
    Password encoding. Valid values: ISO-8859-1, auto.
    passwordRenewal string
    Enable/disable password renewal. Valid values: disable, enable.
    radiusCoa string
    Enable to allow a mechanism to change the attributes of an authentication, authorization, and accounting session after it is authenticated. Valid values: disable, enable.
    radiusPort number
    RADIUS service port number.
    rsso string
    Enable/disable RADIUS based single sign on feature. Valid values: disable, enable.
    rssoContextTimeout number
    Time in seconds before the logged out user is removed from the "user context list" of logged on users.
    rssoEndpointAttribute string
    RADIUS attributes used to extract the user end point identifer from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rssoEndpointBlockAttribute string
    RADIUS attributes used to block a user. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rssoEpOneIpOnly string
    Enable/disable the replacement of old IP addresses with new ones for the same endpoint on RADIUS accounting Start messages. Valid values: disable, enable.
    rssoFlushIpSession string
    Enable/disable flushing user IP sessions on RADIUS accounting Stop messages. Valid values: disable, enable.
    rssoLogFlags string[]
    Events to log. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    rssoLogPeriod number
    Time interval in seconds that group event log messages will be generated for dynamic profile events.
    rssoRadiusResponse string
    Enable/disable sending RADIUS response packets after receiving Start and Stop records. Valid values: disable, enable.
    rssoRadiusServerPort number
    UDP port to listen on for RADIUS Start and Stop records.
    rssoSecrets string[]
    RADIUS secret used by the RADIUS accounting server.
    rssoValidateRequestSecret string
    Enable/disable validating the RADIUS request shared secret in the Start or End record. Valid values: disable, enable.
    secondarySecrets string[]
    Secret key to access the secondary server.
    secondaryServer string
    {<name_str|ip_str>} secondary RADIUS CN domain name or IP.
    secrets string[]
    Pre-shared secret key used to access the primary RADIUS server.
    server string
    Primary RADIUS server CN domain name or IP address.
    serverIdentityCheck string
    Enable/disable RADIUS server identity check (verify server domain name/IP address against the server certificate). Valid values: disable, enable.
    sourceIp string
    Source IP address for communications to the RADIUS server.
    sourceIpInterfaces string[]
    Source interface for communication with the RADIUS server.
    ssoAttribute string
    RADIUS attribute that contains the profile group name to be extracted from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    ssoAttributeKey string
    Key prefix for SSO group value in the SSO attribute.
    ssoAttributeValueOverride string
    Enable/disable override old attribute value with new value for the same endpoint. Valid values: disable, enable.
    statusTtl number
    Time for which server reachability is cached so that when a server is unreachable, it will not be retried for at least this period of time (0 = cache disabled, default = 300).
    switchControllerAcctFastFramedipDetect number
    Switch-Controller-Acct-Fast-Framedip-Detect.
    switchControllerNasIpDynamic string
    Enable/Disable switch-controller nas-ip dynamic to dynamically set nas-ip. Valid values: disable, enable.
    switchControllerServiceTypes string[]
    Switch-Controller-Service-Type. Valid values: login, framed, callback-login, callback-framed, outbound, administrative, nas-prompt, authenticate-only, callback-nas-prompt, call-check, callback-administrative.
    tertiarySecrets string[]
    Secret key to access the tertiary server.
    tertiaryServer string
    {<name_str|ip_str>} tertiary RADIUS CN domain name or IP.
    timeout number
    Time in seconds between re-sending authentication requests.
    tlsMinProtoVersion string
    Minimum supported protocol version for TLS connections (default is to follow system global setting). Valid values: default, TLSv1, TLSv1-1, TLSv1-2, SSLv3.
    transportProtocol string
    Transport protocol to be used (default = udp). Valid values: udp, tcp, tls.
    useGroupForProfile string
    Use-Group-For-Profile. Valid values: disable, enable.
    useManagementVdom string
    Enable/disable using management VDOM to send requests. Valid values: disable, enable.
    usernameCaseSensitive string
    Enable/disable case sensitive user names. Valid values: disable, enable.
    _scopes Sequence[ObjectUserRadiusDynamicMapping_Scope]
    _Scope. The structure of _scope block is documented below.
    account_key_cert_field str
    Define subject identity field in certificate for user access right checking. Valid values: othername, rfc822name, dnsname.
    account_key_processing str
    Account key processing operation. The FortiGate will keep either the whole domain or strip the domain from the subject identity. Valid values: same, strip.
    accounting_servers Sequence[ObjectUserRadiusDynamicMappingAccountingServer]
    Accounting-Server. The structure of accounting_server block is documented below.
    acct_all_servers str
    Enable/disable sending of accounting messages to all configured servers (default = disable). Valid values: disable, enable.
    acct_interim_interval float
    Time in seconds between each accounting interim update message.
    all_usergroup str
    Enable/disable automatically including this RADIUS server in all user groups. Valid values: disable, enable.
    auth_type str
    Authentication methods/protocols permitted for this RADIUS server. Valid values: pap, chap, ms_chap, ms_chap_v2, auto.
    ca_cert str
    CA of server to trust under TLS.
    call_station_id_type str
    Calling & Called station identifier type configuration (default = legacy), this option is not available for 802.1x authentication. Valid values: legacy, IP, MAC.
    classes Sequence[str]
    Class attribute name(s).
    client_cert str
    Client certificate to use under TLS.
    delimiter str
    Delimiter. Valid values: plus, comma.
    dp_carrier_endpoint_attribute str
    Dp-Carrier-Endpoint-Attribute. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Vendor-Specific, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    dp_carrier_endpoint_block_attribute str
    Dp-Carrier-Endpoint-Block-Attribute. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Vendor-Specific, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    dp_context_timeout float
    Dp-Context-Timeout.
    dp_flush_ip_session str
    Dp-Flush-Ip-Session. Valid values: disable, enable.
    dp_hold_time float
    Dp-Hold-Time.
    dp_http_header str
    Dp-Http-Header.
    dp_http_header_fallback str
    Dp-Http-Header-Fallback. Valid values: ip-header-address, default-profile.
    dp_http_header_status str
    Dp-Http-Header-Status. Valid values: disable, enable.
    dp_http_header_suppress str
    Dp-Http-Header-Suppress. Valid values: disable, enable.
    dp_log_dyn_flags Sequence[str]
    Dp-Log-Dyn_Flags. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    dp_log_period float
    Dp-Log-Period.
    dp_mem_percent float
    Dp-Mem-Percent.
    dp_profile_attribute str
    Dp-Profile-Attribute. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Vendor-Specific, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    dp_profile_attribute_key str
    Dp-Profile-Attribute-Key.
    dp_radius_response str
    Dp-Radius-Response. Valid values: disable, enable.
    dp_radius_server_port float
    Dp-Radius-Server-Port.
    dp_secrets Sequence[str]
    Dp-Secret.
    dp_validate_request_secret str
    Dp-Validate-Request-Secret. Valid values: disable, enable.
    dynamic_profile str
    Dynamic-Profile. Valid values: disable, enable.
    endpoint_translation str
    Endpoint-Translation. Valid values: disable, enable.
    ep_carrier_endpoint_convert_hex str
    Ep-Carrier-Endpoint-Convert-Hex. Valid values: disable, enable.
    ep_carrier_endpoint_header str
    Ep-Carrier-Endpoint-Header.
    ep_carrier_endpoint_header_suppress str
    Ep-Carrier-Endpoint-Header-Suppress. Valid values: disable, enable.
    ep_carrier_endpoint_prefix str
    Ep-Carrier-Endpoint-Prefix. Valid values: disable, enable.
    ep_carrier_endpoint_prefix_range_max float
    Ep-Carrier-Endpoint-Prefix-Range-Max.
    ep_carrier_endpoint_prefix_range_min float
    Ep-Carrier-Endpoint-Prefix-Range-Min.
    ep_carrier_endpoint_prefix_string str
    Ep-Carrier-Endpoint-Prefix-String.
    ep_carrier_endpoint_source str
    Ep-Carrier-Endpoint-Source. Valid values: http-header, cookie.
    ep_ip_header str
    Ep-Ip-Header.
    ep_ip_header_suppress str
    Ep-Ip-Header-Suppress. Valid values: disable, enable.
    ep_missing_header_fallback str
    Ep-Missing-Header-Fallback. Valid values: session-ip, policy-profile.
    ep_profile_query_type str
    Ep-Profile-Query-Type. Valid values: session-ip, extract-ip, extract-carrier-endpoint.
    group_override_attr_type str
    Group-Override-Attr-Type. Valid values: filter-Id, class.
    h3c_compatibility str
    Enable/disable compatibility with the H3C, a mechanism that performs security checking for authentication. Valid values: disable, enable.
    interface str
    Specify outgoing interface to reach server.
    interface_select_method str
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    mac_case str
    MAC authentication case (default = lowercase). Valid values: uppercase, lowercase.
    mac_password_delimiter str
    MAC authentication password delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    mac_username_delimiter str
    MAC authentication username delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    nas_id str
    Custom NAS identifier.
    nas_id_type str
    NAS identifier type configuration (default = legacy). Valid values: legacy, custom, hostname.
    nas_ip str
    IP address used to communicate with the RADIUS server and used as NAS-IP-Address and Called-Station-ID attributes.
    password_encoding str
    Password encoding. Valid values: ISO-8859-1, auto.
    password_renewal str
    Enable/disable password renewal. Valid values: disable, enable.
    radius_coa str
    Enable to allow a mechanism to change the attributes of an authentication, authorization, and accounting session after it is authenticated. Valid values: disable, enable.
    radius_port float
    RADIUS service port number.
    rsso str
    Enable/disable RADIUS based single sign on feature. Valid values: disable, enable.
    rsso_context_timeout float
    Time in seconds before the logged out user is removed from the "user context list" of logged on users.
    rsso_endpoint_attribute str
    RADIUS attributes used to extract the user end point identifer from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rsso_endpoint_block_attribute str
    RADIUS attributes used to block a user. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rsso_ep_one_ip_only str
    Enable/disable the replacement of old IP addresses with new ones for the same endpoint on RADIUS accounting Start messages. Valid values: disable, enable.
    rsso_flush_ip_session str
    Enable/disable flushing user IP sessions on RADIUS accounting Stop messages. Valid values: disable, enable.
    rsso_log_flags Sequence[str]
    Events to log. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    rsso_log_period float
    Time interval in seconds that group event log messages will be generated for dynamic profile events.
    rsso_radius_response str
    Enable/disable sending RADIUS response packets after receiving Start and Stop records. Valid values: disable, enable.
    rsso_radius_server_port float
    UDP port to listen on for RADIUS Start and Stop records.
    rsso_secrets Sequence[str]
    RADIUS secret used by the RADIUS accounting server.
    rsso_validate_request_secret str
    Enable/disable validating the RADIUS request shared secret in the Start or End record. Valid values: disable, enable.
    secondary_secrets Sequence[str]
    Secret key to access the secondary server.
    secondary_server str
    {<name_str|ip_str>} secondary RADIUS CN domain name or IP.
    secrets Sequence[str]
    Pre-shared secret key used to access the primary RADIUS server.
    server str
    Primary RADIUS server CN domain name or IP address.
    server_identity_check str
    Enable/disable RADIUS server identity check (verify server domain name/IP address against the server certificate). Valid values: disable, enable.
    source_ip str
    Source IP address for communications to the RADIUS server.
    source_ip_interfaces Sequence[str]
    Source interface for communication with the RADIUS server.
    sso_attribute str
    RADIUS attribute that contains the profile group name to be extracted from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    sso_attribute_key str
    Key prefix for SSO group value in the SSO attribute.
    sso_attribute_value_override str
    Enable/disable override old attribute value with new value for the same endpoint. Valid values: disable, enable.
    status_ttl float
    Time for which server reachability is cached so that when a server is unreachable, it will not be retried for at least this period of time (0 = cache disabled, default = 300).
    switch_controller_acct_fast_framedip_detect float
    Switch-Controller-Acct-Fast-Framedip-Detect.
    switch_controller_nas_ip_dynamic str
    Enable/Disable switch-controller nas-ip dynamic to dynamically set nas-ip. Valid values: disable, enable.
    switch_controller_service_types Sequence[str]
    Switch-Controller-Service-Type. Valid values: login, framed, callback-login, callback-framed, outbound, administrative, nas-prompt, authenticate-only, callback-nas-prompt, call-check, callback-administrative.
    tertiary_secrets Sequence[str]
    Secret key to access the tertiary server.
    tertiary_server str
    {<name_str|ip_str>} tertiary RADIUS CN domain name or IP.
    timeout float
    Time in seconds between re-sending authentication requests.
    tls_min_proto_version str
    Minimum supported protocol version for TLS connections (default is to follow system global setting). Valid values: default, TLSv1, TLSv1-1, TLSv1-2, SSLv3.
    transport_protocol str
    Transport protocol to be used (default = udp). Valid values: udp, tcp, tls.
    use_group_for_profile str
    Use-Group-For-Profile. Valid values: disable, enable.
    use_management_vdom str
    Enable/disable using management VDOM to send requests. Valid values: disable, enable.
    username_case_sensitive str
    Enable/disable case sensitive user names. Valid values: disable, enable.
    _scopes List<Property Map>
    _Scope. The structure of _scope block is documented below.
    accountKeyCertField String
    Define subject identity field in certificate for user access right checking. Valid values: othername, rfc822name, dnsname.
    accountKeyProcessing String
    Account key processing operation. The FortiGate will keep either the whole domain or strip the domain from the subject identity. Valid values: same, strip.
    accountingServers List<Property Map>
    Accounting-Server. The structure of accounting_server block is documented below.
    acctAllServers String
    Enable/disable sending of accounting messages to all configured servers (default = disable). Valid values: disable, enable.
    acctInterimInterval Number
    Time in seconds between each accounting interim update message.
    allUsergroup String
    Enable/disable automatically including this RADIUS server in all user groups. Valid values: disable, enable.
    authType String
    Authentication methods/protocols permitted for this RADIUS server. Valid values: pap, chap, ms_chap, ms_chap_v2, auto.
    caCert String
    CA of server to trust under TLS.
    callStationIdType String
    Calling & Called station identifier type configuration (default = legacy), this option is not available for 802.1x authentication. Valid values: legacy, IP, MAC.
    classes List<String>
    Class attribute name(s).
    clientCert String
    Client certificate to use under TLS.
    delimiter String
    Delimiter. Valid values: plus, comma.
    dpCarrierEndpointAttribute String
    Dp-Carrier-Endpoint-Attribute. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Vendor-Specific, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    dpCarrierEndpointBlockAttribute String
    Dp-Carrier-Endpoint-Block-Attribute. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Vendor-Specific, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    dpContextTimeout Number
    Dp-Context-Timeout.
    dpFlushIpSession String
    Dp-Flush-Ip-Session. Valid values: disable, enable.
    dpHoldTime Number
    Dp-Hold-Time.
    dpHttpHeader String
    Dp-Http-Header.
    dpHttpHeaderFallback String
    Dp-Http-Header-Fallback. Valid values: ip-header-address, default-profile.
    dpHttpHeaderStatus String
    Dp-Http-Header-Status. Valid values: disable, enable.
    dpHttpHeaderSuppress String
    Dp-Http-Header-Suppress. Valid values: disable, enable.
    dpLogDynFlags List<String>
    Dp-Log-Dyn_Flags. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    dpLogPeriod Number
    Dp-Log-Period.
    dpMemPercent Number
    Dp-Mem-Percent.
    dpProfileAttribute String
    Dp-Profile-Attribute. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Vendor-Specific, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    dpProfileAttributeKey String
    Dp-Profile-Attribute-Key.
    dpRadiusResponse String
    Dp-Radius-Response. Valid values: disable, enable.
    dpRadiusServerPort Number
    Dp-Radius-Server-Port.
    dpSecrets List<String>
    Dp-Secret.
    dpValidateRequestSecret String
    Dp-Validate-Request-Secret. Valid values: disable, enable.
    dynamicProfile String
    Dynamic-Profile. Valid values: disable, enable.
    endpointTranslation String
    Endpoint-Translation. Valid values: disable, enable.
    epCarrierEndpointConvertHex String
    Ep-Carrier-Endpoint-Convert-Hex. Valid values: disable, enable.
    epCarrierEndpointHeader String
    Ep-Carrier-Endpoint-Header.
    epCarrierEndpointHeaderSuppress String
    Ep-Carrier-Endpoint-Header-Suppress. Valid values: disable, enable.
    epCarrierEndpointPrefix String
    Ep-Carrier-Endpoint-Prefix. Valid values: disable, enable.
    epCarrierEndpointPrefixRangeMax Number
    Ep-Carrier-Endpoint-Prefix-Range-Max.
    epCarrierEndpointPrefixRangeMin Number
    Ep-Carrier-Endpoint-Prefix-Range-Min.
    epCarrierEndpointPrefixString String
    Ep-Carrier-Endpoint-Prefix-String.
    epCarrierEndpointSource String
    Ep-Carrier-Endpoint-Source. Valid values: http-header, cookie.
    epIpHeader String
    Ep-Ip-Header.
    epIpHeaderSuppress String
    Ep-Ip-Header-Suppress. Valid values: disable, enable.
    epMissingHeaderFallback String
    Ep-Missing-Header-Fallback. Valid values: session-ip, policy-profile.
    epProfileQueryType String
    Ep-Profile-Query-Type. Valid values: session-ip, extract-ip, extract-carrier-endpoint.
    groupOverrideAttrType String
    Group-Override-Attr-Type. Valid values: filter-Id, class.
    h3cCompatibility String
    Enable/disable compatibility with the H3C, a mechanism that performs security checking for authentication. Valid values: disable, enable.
    interface String
    Specify outgoing interface to reach server.
    interfaceSelectMethod String
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    macCase String
    MAC authentication case (default = lowercase). Valid values: uppercase, lowercase.
    macPasswordDelimiter String
    MAC authentication password delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    macUsernameDelimiter String
    MAC authentication username delimiter (default = hyphen). Valid values: hyphen, single-hyphen, colon, none.
    nasId String
    Custom NAS identifier.
    nasIdType String
    NAS identifier type configuration (default = legacy). Valid values: legacy, custom, hostname.
    nasIp String
    IP address used to communicate with the RADIUS server and used as NAS-IP-Address and Called-Station-ID attributes.
    passwordEncoding String
    Password encoding. Valid values: ISO-8859-1, auto.
    passwordRenewal String
    Enable/disable password renewal. Valid values: disable, enable.
    radiusCoa String
    Enable to allow a mechanism to change the attributes of an authentication, authorization, and accounting session after it is authenticated. Valid values: disable, enable.
    radiusPort Number
    RADIUS service port number.
    rsso String
    Enable/disable RADIUS based single sign on feature. Valid values: disable, enable.
    rssoContextTimeout Number
    Time in seconds before the logged out user is removed from the "user context list" of logged on users.
    rssoEndpointAttribute String
    RADIUS attributes used to extract the user end point identifer from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rssoEndpointBlockAttribute String
    RADIUS attributes used to block a user. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    rssoEpOneIpOnly String
    Enable/disable the replacement of old IP addresses with new ones for the same endpoint on RADIUS accounting Start messages. Valid values: disable, enable.
    rssoFlushIpSession String
    Enable/disable flushing user IP sessions on RADIUS accounting Stop messages. Valid values: disable, enable.
    rssoLogFlags List<String>
    Events to log. Valid values: none, protocol-error, profile-missing, context-missing, accounting-stop-missed, accounting-event, radiusd-other, endpoint-block.
    rssoLogPeriod Number
    Time interval in seconds that group event log messages will be generated for dynamic profile events.
    rssoRadiusResponse String
    Enable/disable sending RADIUS response packets after receiving Start and Stop records. Valid values: disable, enable.
    rssoRadiusServerPort Number
    UDP port to listen on for RADIUS Start and Stop records.
    rssoSecrets List<String>
    RADIUS secret used by the RADIUS accounting server.
    rssoValidateRequestSecret String
    Enable/disable validating the RADIUS request shared secret in the Start or End record. Valid values: disable, enable.
    secondarySecrets List<String>
    Secret key to access the secondary server.
    secondaryServer String
    {<name_str|ip_str>} secondary RADIUS CN domain name or IP.
    secrets List<String>
    Pre-shared secret key used to access the primary RADIUS server.
    server String
    Primary RADIUS server CN domain name or IP address.
    serverIdentityCheck String
    Enable/disable RADIUS server identity check (verify server domain name/IP address against the server certificate). Valid values: disable, enable.
    sourceIp String
    Source IP address for communications to the RADIUS server.
    sourceIpInterfaces List<String>
    Source interface for communication with the RADIUS server.
    ssoAttribute String
    RADIUS attribute that contains the profile group name to be extracted from the RADIUS Start record. Valid values: User-Name, User-Password, CHAP-Password, NAS-IP-Address, NAS-Port, Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Routing, Filter-Id, Framed-MTU, Framed-Compression, Login-IP-Host, Login-Service, Login-TCP-Port, Reply-Message, Callback-Number, Callback-Id, Framed-Route, Framed-IPX-Network, State, Class, Session-Timeout, Idle-Timeout, Termination-Action, Called-Station-Id, Calling-Station-Id, NAS-Identifier, Proxy-State, Login-LAT-Service, Login-LAT-Node, Login-LAT-Group, Framed-AppleTalk-Link, Framed-AppleTalk-Network, Framed-AppleTalk-Zone, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session-Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct-Multi-Session-Id, Acct-Link-Count, CHAP-Challenge, NAS-Port-Type, Port-Limit, Login-LAT-Port.
    ssoAttributeKey String
    Key prefix for SSO group value in the SSO attribute.
    ssoAttributeValueOverride String
    Enable/disable override old attribute value with new value for the same endpoint. Valid values: disable, enable.
    statusTtl Number
    Time for which server reachability is cached so that when a server is unreachable, it will not be retried for at least this period of time (0 = cache disabled, default = 300).
    switchControllerAcctFastFramedipDetect Number
    Switch-Controller-Acct-Fast-Framedip-Detect.
    switchControllerNasIpDynamic String
    Enable/Disable switch-controller nas-ip dynamic to dynamically set nas-ip. Valid values: disable, enable.
    switchControllerServiceTypes List<String>
    Switch-Controller-Service-Type. Valid values: login, framed, callback-login, callback-framed, outbound, administrative, nas-prompt, authenticate-only, callback-nas-prompt, call-check, callback-administrative.
    tertiarySecrets List<String>
    Secret key to access the tertiary server.
    tertiaryServer String
    {<name_str|ip_str>} tertiary RADIUS CN domain name or IP.
    timeout Number
    Time in seconds between re-sending authentication requests.
    tlsMinProtoVersion String
    Minimum supported protocol version for TLS connections (default is to follow system global setting). Valid values: default, TLSv1, TLSv1-1, TLSv1-2, SSLv3.
    transportProtocol String
    Transport protocol to be used (default = udp). Valid values: udp, tcp, tls.
    useGroupForProfile String
    Use-Group-For-Profile. Valid values: disable, enable.
    useManagementVdom String
    Enable/disable using management VDOM to send requests. Valid values: disable, enable.
    usernameCaseSensitive String
    Enable/disable case sensitive user names. Valid values: disable, enable.

    ObjectUserRadiusDynamicMappingAccountingServer, ObjectUserRadiusDynamicMappingAccountingServerArgs

    Id double
    ID (0 - 4294967295).
    Interface string
    Specify outgoing interface to reach server.
    InterfaceSelectMethod string
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    Port double
    RADIUS accounting port number.
    Secrets List<string>
    Secret key.
    Server string
    {<name_str|ip_str>} Server CN domain name or IP.
    SourceIp string
    Source IP address for communications to the RADIUS server.
    Status string
    Status. Valid values: disable, enable.
    Id float64
    ID (0 - 4294967295).
    Interface string
    Specify outgoing interface to reach server.
    InterfaceSelectMethod string
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    Port float64
    RADIUS accounting port number.
    Secrets []string
    Secret key.
    Server string
    {<name_str|ip_str>} Server CN domain name or IP.
    SourceIp string
    Source IP address for communications to the RADIUS server.
    Status string
    Status. Valid values: disable, enable.
    id Double
    ID (0 - 4294967295).
    interfaceSelectMethod String
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    interface_ String
    Specify outgoing interface to reach server.
    port Double
    RADIUS accounting port number.
    secrets List<String>
    Secret key.
    server String
    {<name_str|ip_str>} Server CN domain name or IP.
    sourceIp String
    Source IP address for communications to the RADIUS server.
    status String
    Status. Valid values: disable, enable.
    id number
    ID (0 - 4294967295).
    interface string
    Specify outgoing interface to reach server.
    interfaceSelectMethod string
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    port number
    RADIUS accounting port number.
    secrets string[]
    Secret key.
    server string
    {<name_str|ip_str>} Server CN domain name or IP.
    sourceIp string
    Source IP address for communications to the RADIUS server.
    status string
    Status. Valid values: disable, enable.
    id float
    ID (0 - 4294967295).
    interface str
    Specify outgoing interface to reach server.
    interface_select_method str
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    port float
    RADIUS accounting port number.
    secrets Sequence[str]
    Secret key.
    server str
    {<name_str|ip_str>} Server CN domain name or IP.
    source_ip str
    Source IP address for communications to the RADIUS server.
    status str
    Status. Valid values: disable, enable.
    id Number
    ID (0 - 4294967295).
    interface String
    Specify outgoing interface to reach server.
    interfaceSelectMethod String
    Specify how to select outgoing interface to reach server. Valid values: auto, sdwan, specify.
    port Number
    RADIUS accounting port number.
    secrets List<String>
    Secret key.
    server String
    {<name_str|ip_str>} Server CN domain name or IP.
    sourceIp String
    Source IP address for communications to the RADIUS server.
    status String
    Status. Valid values: disable, enable.

    ObjectUserRadiusDynamicMapping_Scope, ObjectUserRadiusDynamicMapping_ScopeArgs

    Name string
    Name.
    Vdom string
    Vdom.
    Name string
    Name.
    Vdom string
    Vdom.
    name String
    Name.
    vdom String
    Vdom.
    name string
    Name.
    vdom string
    Vdom.
    name str
    Name.
    vdom str
    Vdom.
    name String
    Name.
    vdom String
    Vdom.

    Import

    ObjectUser Radius can be imported using any of these accepted formats:

    $ export “FORTIMANAGER_IMPORT_TABLE”=“true”

    $ pulumi import fortimanager:index/objectUserRadius:ObjectUserRadius labelname {{name}}

    $ unset “FORTIMANAGER_IMPORT_TABLE”

    -> Hint: The scopetype and adom for import will directly inherit the scopetype and adom configuration of the provider.

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    fortimanager fortinetdev/terraform-provider-fortimanager
    License
    Notes
    This Pulumi package is based on the fortimanager Terraform Provider.
    fortimanager logo
    fortimanager 1.13.0 published on Thursday, Mar 13, 2025 by fortinetdev
    fortinetdev/terraform-provider-fortimanager