fortios_user_group fails to add an LDAP group -- CLI err -56 about ansible-galaxy-fortios-collection

[FredPocai]

That'll do it -- the role wasn't using the galaxy module, it was using the legacy ansible module. I had specified it in the main playbook but not in the role itself. Added the collection to role/name/meta/main.yml and it worked.

Thanks for your help.

[JieX19]

Hi @freddygfy,

Fortios collection supports version6 but not v5. I cannot reproduce the error on my side with FOS6.0.7m 6.2.3 and 6.4.0.

Can you please try the following playbook? Let's try the simple one and see what the errors are. Please make sure to create the members/users before setting user_group.

- hosts: fortigates
  connection: httpapi
  collections:
    - fortinet.fortios
  vars:
    ansible_httpapi_use_ssl: yes
    ansible_httpapi_validate_certs: no
    ansible_httpapi_port: 443
    vdom: "root"
  tasks:
  - name: Configure user group
    fortios_user_group:
      vdom: "{{ vdom }}"
      state: "present"
      user_group:
        name: "Firewall_group_test"
        group_type: "firewall"
        member:
          - name: "firewall_user_1"

[FredPocai]

This worked as expected...the problem seems to be limited to remote groups, or at least LDAP remote groups.

I've recreated this issue again today on 6.2.3 and 6.0.10, as well. The information under the "match" section doesn't get sent,

Here's a di de cli 8 from the 6.2.3 firewall today:

0: end
0: config user group
0: edit "<< ldap_group_name >>"
0: end
0: config user group
0: edit " << ldap_group_name >>"
0: config match
0: edit 1
-56: end

It seems it's trying to exit the "config match" without entering any match criteria, throwing an error.

Play output, -vvvvv, sanitized:

TASK [init : Add LDAP Group - Part 1] *********************************************************************************************************************************************
task path: /home/<myuser>/git/fortigate_baseline/roles/init/tasks/04-add_ldap_group.yml:1
fatal: [<ansible_hostname>]: FAILED! => changed=false 
  invocation:
    module_args:
      host: null
      https: true
      password: ''
      ssl_verify: true
      state: present
      user_group:
        auth_concurrent_override: null
        auth_concurrent_value: null
        authtimeout: null
        company: null
        email: null
        expire: null
        expire_type: null
        group_type: firewall
        guest: null
        http_digest_realm: null
        id: null
        match:
        - group_name: <ldapadmin_group(DN)>
          id: 1
          server_name: < fw_ldap_server_name >
        max_accounts: null
        member:
        - name: < fw_ldap_server_name >
        mobile_phone: null
        multiple_guest_add: null
        name: < fw_ldap_group_name >
        password: null
        sms_custom_server: null
        sms_server: null
        sponsor: null
        sso_attribute_value: null
        user_id: null
        user_name: null
      username: null
      vdom: root
  meta:
    build: 6188
    error: -5
    http_method: POST
    http_status: 500
    name: group
    path: user
    revision: <redacted>
    revision_changed: false
    serial: <redacted>
    status: error
    vdom: root
    version: v6.2.3
  msg: Error in repo

ansible 2.9.13, python version = 3.6.8

[FredPocai]

I believe I've found the cause of the issue...the underscore-to-hyphen operation doesn't seem to be happening for server_name and group_name...this was captured from a tcpdump going to the fortigate with SSL disabled:

{"member": [{"name": "FW_LDAP_SERVER_NAME"}], "group-type": "firewall", "name": "FW_LDAP_GROUP_NAME", "match": [{"server_name": "FW_LDAP_SERVER_NAME", "group_name": "CN=LDAP_GROUP,OU=PATH,OU=PATH,DC=DOMAIN,DC=COM"}]}

Edit to add: Surprisingly, and contrary to documentation, this worked:

- name: Add Network Automation Group 
  fortios_user_group:
    vdom: "root"
    state: "present"
    user_group:
      name: "{{ fw_ldap_group_name }}"
      group_type: "firewall"
      member: 
       - name: "{{ fw_ldap_server_name }}"
      match: 
       -  server-name: "{{ fw_ldap_server_name }}"
          group-name: "{{ ldap_group_dn }}"
          id: 1

[JieX19]

@freddygfy,

Thank you for your info! It's a bit weird, because I used the same playbook as yours and everything works well. I did not change server_name to server-name. It seems you are using an old version of ansible modules. We did fix this issue early this year.

Can you please check a file for me? If possible, please copy and paste the underscore_to_hyphen function here. Thank you very much!
less ~/.ansible/collections/ansible_collections/fortinet/fortios/plugins/modules/fortios_user_group.py , you will find the underscore_to_hyphen() in this file.

The function should be:

def underscore_to_hyphen(data):
    if isinstance(data, list):
        for i, elem in enumerate(data):
            data[i] = underscore_to_hyphen(elem)
    elif isinstance(data, dict):
        new_data = {}
        for k, v in data.items():
            new_data[k.replace('_', '-')] = underscore_to_hyphen(v)
        data = new_data

    return data