<reponame>pulumiverse/pulumi-fortios<gh_stars>0// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***

using System;
using System.Collections.Generic;
using System.Collections.Immutable;
using System.Threading.Tasks;
using Pulumi.Serialization;
using Pulumi;

namespace Pulumiverse.Fortios
{
    /// <summary>
    /// Configure RADIUS server entries.
    /// 
    /// ## Example Usage
    /// 
    /// ```csharp
    /// using System.Collections.Generic;
    /// using System.Linq;
    /// using Pulumi;
    /// using Fortios = Pulumiverse.Fortios;
    /// 
    /// return await Deployment.RunAsync(() =&gt; 
    /// {
    ///     var trname = new Fortios.UserRadius("trname", new()
    ///     {
    ///         AcctAllServers = "disable",
    ///         AllUsergroup = "disable",
    ///         AuthType = "auto",
    ///         H3cCompatibility = "disable",
    ///         NasIp = "0.0.0.0",
    ///         PasswordEncoding = "auto",
    ///         PasswordRenewal = "disable",
    ///         RadiusCoa = "disable",
    ///         RadiusPort = 0,
    ///         Rsso = "disable",
    ///         RssoContextTimeout = 28800,
    ///         RssoEndpointAttribute = "Calling-Station-Id",
    ///         RssoEpOneIpOnly = "disable",
    ///         RssoFlushIpSession = "disable",
    ///         RssoLogFlags = "protocol-error profile-missing accounting-stop-missed accounting-event endpoint-block radiusd-other",
    ///         RssoLogPeriod = 0,
    ///         RssoRadiusResponse = "disable",
    ///         RssoRadiusServerPort = 1813,
    ///         RssoValidateRequestSecret = "disable",
    ///         Secret = "FDaaewjkeiw32",
    ///         Server = "1.1.1.1",
    ///         SsoAttribute = "Class",
    ///         SsoAttributeValueOverride = "enable",
    ///         Timeout = 5,
    ///         UseManagementVdom = "disable",
    ///         UsernameCaseSensitive = "disable",
    ///     });
    /// 
    /// });
    /// ```
    /// 
    /// ## Import
    /// 
    /// User Radius can be imported using any of these accepted formats
    /// 
    /// ```sh
    ///  $ pulumi import fortios:index/userRadius:UserRadius labelname {{name}}
    /// ```
    /// 
    ///  If you do not want to import arguments of block$ export "FORTIOS_IMPORT_TABLE"="false"
    /// 
    /// ```sh
    ///  $ pulumi import fortios:index/userRadius:UserRadius labelname {{name}}
    /// ```
    /// 
    ///  $ unset "FORTIOS_IMPORT_TABLE"
    /// </summary>
    [FortiosResourceType("fortios:index/userRadius:UserRadius")]
    public partial class UserRadius : global::Pulumi.CustomResource
    {
        /// <summary>
        /// Additional accounting servers. The structure of `accounting_server` block is documented below.
        /// </summary>
        [Output("accountingServers")]
        public Output<ImmutableArray<Outputs.UserRadiusAccountingServer>> AccountingServers { get; private set; } = null!;

        /// <summary>
        /// Enable/disable sending of accounting messages to all configured servers (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Output("acctAllServers")]
        public Output<string> AcctAllServers { get; private set; } = null!;

        /// <summary>
        /// Time in seconds between each accounting interim update message.
        /// </summary>
        [Output("acctInterimInterval")]
        public Output<int> AcctInterimInterval { get; private set; } = null!;

        /// <summary>
        /// Enable/disable automatically including this RADIUS server in all user groups. Valid values: `disable`, `enable`.
        /// </summary>
        [Output("allUsergroup")]
        public Output<string> AllUsergroup { get; private set; } = null!;

        /// <summary>
        /// Authentication methods/protocols permitted for this RADIUS server. Valid values: `auto`, `ms_chap_v2`, `ms_chap`, `chap`, `pap`.
        /// </summary>
        [Output("authType")]
        public Output<string> AuthType { get; private set; } = null!;

        /// <summary>
        /// Class attribute name(s). The structure of `class` block is documented below.
        /// </summary>
        [Output("classes")]
        public Output<ImmutableArray<Outputs.UserRadiusClass>> Classes { get; private set; } = null!;

        /// <summary>
        /// Configure delimiter to be used for separating profile group names in the SSO attribute (default = plus character "+"). Valid values: `plus`, `comma`.
        /// </summary>
        [Output("delimiter")]
        public Output<string> Delimiter { get; private set; } = null!;

        /// <summary>
        /// Sort sub-tables, please do not set this parameter when configuring static sub-tables. Options: [ false, true, natural, alphabetical ]. false: Default value, do not sort tables; true/natural: sort tables in natural order. For example: [ a10, a2 ] -&gt; [ a2, a10 ]; alphabetical: sort tables in alphabetical order. For example: [ a10, a2 ] -&gt; [ a10, a2 ].
        /// </summary>
        [Output("dynamicSortSubtable")]
        public Output<string?> DynamicSortSubtable { get; private set; } = null!;

        /// <summary>
        /// RADIUS attribute type to override user group information. Valid values: `filter-Id`, `class`.
        /// </summary>
        [Output("groupOverrideAttrType")]
        public Output<string> GroupOverrideAttrType { get; private set; } = null!;

        /// <summary>
        /// Enable/disable compatibility with the H3C, a mechanism that performs security checking for authentication. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("h3cCompatibility")]
        public Output<string> H3cCompatibility { get; private set; } = null!;

        /// <summary>
        /// Specify outgoing interface to reach server.
        /// </summary>
        [Output("interface")]
        public Output<string> Interface { get; private set; } = null!;

        /// <summary>
        /// Specify how to select outgoing interface to reach server. Valid values: `auto`, `sdwan`, `specify`.
        /// </summary>
        [Output("interfaceSelectMethod")]
        public Output<string> InterfaceSelectMethod { get; private set; } = null!;

        /// <summary>
        /// MAC authentication case (default = lowercase). Valid values: `uppercase`, `lowercase`.
        /// </summary>
        [Output("macCase")]
        public Output<string> MacCase { get; private set; } = null!;

        /// <summary>
        /// MAC authentication password delimiter (default = hyphen). Valid values: `hyphen`, `single-hyphen`, `colon`, `none`.
        /// </summary>
        [Output("macPasswordDelimiter")]
        public Output<string> MacPasswordDelimiter { get; private set; } = null!;

        /// <summary>
        /// MAC authentication username delimiter (default = hyphen). Valid values: `hyphen`, `single-hyphen`, `colon`, `none`.
        /// </summary>
        [Output("macUsernameDelimiter")]
        public Output<string> MacUsernameDelimiter { get; private set; } = null!;

        /// <summary>
        /// RADIUS server entry name.
        /// </summary>
        [Output("name")]
        public Output<string> Name { get; private set; } = null!;

        /// <summary>
        /// IP address used to communicate with the RADIUS server and used as NAS-IP-Address and Called-Station-ID attributes.
        /// </summary>
        [Output("nasIp")]
        public Output<string> NasIp { get; private set; } = null!;

        /// <summary>
        /// Password encoding. Valid values: `auto`, `ISO-8859-1`.
        /// </summary>
        [Output("passwordEncoding")]
        public Output<string> PasswordEncoding { get; private set; } = null!;

        /// <summary>
        /// Enable/disable password renewal. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("passwordRenewal")]
        public Output<string> PasswordRenewal { get; private set; } = null!;

        /// <summary>
        /// Enable to allow a mechanism to change the attributes of an authentication, authorization, and accounting session after it is authenticated. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("radiusCoa")]
        public Output<string> RadiusCoa { get; private set; } = null!;

        /// <summary>
        /// RADIUS service port number.
        /// </summary>
        [Output("radiusPort")]
        public Output<int> RadiusPort { get; private set; } = null!;

        /// <summary>
        /// Enable/disable RADIUS based single sign on feature. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("rsso")]
        public Output<string> Rsso { get; private set; } = null!;

        /// <summary>
        /// Time in seconds before the logged out user is removed from the "user context list" of logged on users.
        /// </summary>
        [Output("rssoContextTimeout")]
        public Output<int> RssoContextTimeout { get; private set; } = null!;

        /// <summary>
        /// RADIUS attributes used to extract the user end point identifer from the RADIUS Start record. Valid values: `User-Name`, `NAS-IP-Address`, `Framed-IP-Address`, `Framed-IP-Netmask`, `Filter-Id`, `Login-IP-Host`, `Reply-Message`, `Callback-Number`, `Callback-Id`, `Framed-Route`, `Framed-IPX-Network`, `Class`, `Called-Station-Id`, `Calling-Station-Id`, `NAS-Identifier`, `Proxy-State`, `Login-LAT-Service`, `Login-LAT-Node`, `Login-LAT-Group`, `Framed-AppleTalk-Zone`, `Acct-Session-Id`, `Acct-Multi-Session-Id`.
        /// </summary>
        [Output("rssoEndpointAttribute")]
        public Output<string> RssoEndpointAttribute { get; private set; } = null!;

        /// <summary>
        /// RADIUS attributes used to block a user. Valid values: `User-Name`, `NAS-IP-Address`, `Framed-IP-Address`, `Framed-IP-Netmask`, `Filter-Id`, `Login-IP-Host`, `Reply-Message`, `Callback-Number`, `Callback-Id`, `Framed-Route`, `Framed-IPX-Network`, `Class`, `Called-Station-Id`, `Calling-Station-Id`, `NAS-Identifier`, `Proxy-State`, `Login-LAT-Service`, `Login-LAT-Node`, `Login-LAT-Group`, `Framed-AppleTalk-Zone`, `Acct-Session-Id`, `Acct-Multi-Session-Id`.
        /// </summary>
        [Output("rssoEndpointBlockAttribute")]
        public Output<string> RssoEndpointBlockAttribute { get; private set; } = null!;

        /// <summary>
        /// Enable/disable the replacement of old IP addresses with new ones for the same endpoint on RADIUS accounting Start messages. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("rssoEpOneIpOnly")]
        public Output<string> RssoEpOneIpOnly { get; private set; } = null!;

        /// <summary>
        /// Enable/disable flushing user IP sessions on RADIUS accounting Stop messages. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("rssoFlushIpSession")]
        public Output<string> RssoFlushIpSession { get; private set; } = null!;

        /// <summary>
        /// Events to log. Valid values: `protocol-error`, `profile-missing`, `accounting-stop-missed`, `accounting-event`, `endpoint-block`, `radiusd-other`, `none`.
        /// </summary>
        [Output("rssoLogFlags")]
        public Output<string> RssoLogFlags { get; private set; } = null!;

        /// <summary>
        /// Time interval in seconds that group event log messages will be generated for dynamic profile events.
        /// </summary>
        [Output("rssoLogPeriod")]
        public Output<int> RssoLogPeriod { get; private set; } = null!;

        /// <summary>
        /// Enable/disable sending RADIUS response packets after receiving Start and Stop records. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("rssoRadiusResponse")]
        public Output<string> RssoRadiusResponse { get; private set; } = null!;

        /// <summary>
        /// UDP port to listen on for RADIUS Start and Stop records.
        /// </summary>
        [Output("rssoRadiusServerPort")]
        public Output<int> RssoRadiusServerPort { get; private set; } = null!;

        /// <summary>
        /// RADIUS secret used by the RADIUS accounting server.
        /// </summary>
        [Output("rssoSecret")]
        public Output<string?> RssoSecret { get; private set; } = null!;

        /// <summary>
        /// Enable/disable validating the RADIUS request shared secret in the Start or End record. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("rssoValidateRequestSecret")]
        public Output<string> RssoValidateRequestSecret { get; private set; } = null!;

        /// <summary>
        /// Secret key to access the secondary server.
        /// </summary>
        [Output("secondarySecret")]
        public Output<string?> SecondarySecret { get; private set; } = null!;

        /// <summary>
        /// {&lt;name_str|ip_str&gt;} secondary RADIUS CN domain name or IP.
        /// </summary>
        [Output("secondaryServer")]
        public Output<string> SecondaryServer { get; private set; } = null!;

        /// <summary>
        /// Pre-shared secret key used to access the primary RADIUS server.
        /// </summary>
        [Output("secret")]
        public Output<string?> Secret { get; private set; } = null!;

        /// <summary>
        /// Primary RADIUS server CN domain name or IP address.
        /// </summary>
        [Output("server")]
        public Output<string> Server { get; private set; } = null!;

        /// <summary>
        /// Source IP address for communications to the RADIUS server.
        /// </summary>
        [Output("sourceIp")]
        public Output<string> SourceIp { get; private set; } = null!;

        /// <summary>
        /// RADIUS attribute that contains the profile group name to be extracted from the RADIUS Start record. Valid values: `User-Name`, `NAS-IP-Address`, `Framed-IP-Address`, `Framed-IP-Netmask`, `Filter-Id`, `Login-IP-Host`, `Reply-Message`, `Callback-Number`, `Callback-Id`, `Framed-Route`, `Framed-IPX-Network`, `Class`, `Called-Station-Id`, `Calling-Station-Id`, `NAS-Identifier`, `Proxy-State`, `Login-LAT-Service`, `Login-LAT-Node`, `Login-LAT-Group`, `Framed-AppleTalk-Zone`, `Acct-Session-Id`, `Acct-Multi-Session-Id`.
        /// </summary>
        [Output("ssoAttribute")]
        public Output<string> SsoAttribute { get; private set; } = null!;

        /// <summary>
        /// Key prefix for SSO group value in the SSO attribute.
        /// </summary>
        [Output("ssoAttributeKey")]
        public Output<string> SsoAttributeKey { get; private set; } = null!;

        /// <summary>
        /// Enable/disable override old attribute value with new value for the same endpoint. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("ssoAttributeValueOverride")]
        public Output<string> SsoAttributeValueOverride { get; private set; } = null!;

        /// <summary>
        /// Switch controller accounting message Framed-IP detection from DHCP snooping (seconds, default=2).
        /// </summary>
        [Output("switchControllerAcctFastFramedipDetect")]
        public Output<int> SwitchControllerAcctFastFramedipDetect { get; private set; } = null!;

        /// <summary>
        /// RADIUS service type. Valid values: `login`, `framed`, `callback-login`, `callback-framed`, `outbound`, `administrative`, `nas-prompt`, `authenticate-only`, `callback-nas-prompt`, `call-check`, `callback-administrative`.
        /// </summary>
        [Output("switchControllerServiceType")]
        public Output<string> SwitchControllerServiceType { get; private set; } = null!;

        /// <summary>
        /// Secret key to access the tertiary server.
        /// </summary>
        [Output("tertiarySecret")]
        public Output<string?> TertiarySecret { get; private set; } = null!;

        /// <summary>
        /// {&lt;name_str|ip_str&gt;} tertiary RADIUS CN domain name or IP.
        /// </summary>
        [Output("tertiaryServer")]
        public Output<string> TertiaryServer { get; private set; } = null!;

        /// <summary>
        /// Time in seconds between re-sending authentication requests.
        /// </summary>
        [Output("timeout")]
        public Output<int> Timeout { get; private set; } = null!;

        /// <summary>
        /// Enable/disable using management VDOM to send requests. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("useManagementVdom")]
        public Output<string> UseManagementVdom { get; private set; } = null!;

        /// <summary>
        /// Enable/disable case sensitive user names. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("usernameCaseSensitive")]
        public Output<string> UsernameCaseSensitive { get; private set; } = null!;

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Output("vdomparam")]
        public Output<string?> Vdomparam { get; private set; } = null!;


        /// <summary>
        /// Create a UserRadius resource with the given unique name, arguments, and options.
        /// </summary>
        ///
        /// <param name="name">The unique name of the resource</param>
        /// <param name="args">The arguments used to populate this resource's properties</param>
        /// <param name="options">A bag of options that control this resource's behavior</param>
        public UserRadius(string name, UserRadiusArgs? args = null, CustomResourceOptions? options = null)
            : base("fortios:index/userRadius:UserRadius", name, args ?? new UserRadiusArgs(), MakeResourceOptions(options, ""))
        {
        }

        private UserRadius(string name, Input<string> id, UserRadiusState? state = null, CustomResourceOptions? options = null)
            : base("fortios:index/userRadius:UserRadius", name, state, MakeResourceOptions(options, id))
        {
        }

        private static CustomResourceOptions MakeResourceOptions(CustomResourceOptions? options, Input<string>? id)
        {
            var defaultOptions = new CustomResourceOptions
            {
                Version = Utilities.Version,
                PluginDownloadURL = "github://api.github.com/pulumiverse/pulumi-fortios",
                AdditionalSecretOutputs =
                {
                    "rssoSecret",
                    "secondarySecret",
                    "secret",
                    "ssoAttributeKey",
                    "tertiarySecret",
                },
            };
            var merged = CustomResourceOptions.Merge(defaultOptions, options);
            // Override the ID if one was specified for consistency with other language SDKs.
            merged.Id = id ?? merged.Id;
            return merged;
        }
        /// <summary>
        /// Get an existing UserRadius resource's state with the given name, ID, and optional extra
        /// properties used to qualify the lookup.
        /// </summary>
        ///
        /// <param name="name">The unique name of the resulting resource.</param>
        /// <param name="id">The unique provider ID of the resource to lookup.</param>
        /// <param name="state">Any extra arguments used during the lookup.</param>
        /// <param name="options">A bag of options that control this resource's behavior</param>
        public static UserRadius Get(string name, Input<string> id, UserRadiusState? state = null, CustomResourceOptions? options = null)
        {
            return new UserRadius(name, id, state, options);
        }
    }

    public sealed class UserRadiusArgs : global::Pulumi.ResourceArgs
    {
        [Input("accountingServers")]
        private InputList<Inputs.UserRadiusAccountingServerArgs>? _accountingServers;

        /// <summary>
        /// Additional accounting servers. The structure of `accounting_server` block is documented below.
        /// </summary>
        public InputList<Inputs.UserRadiusAccountingServerArgs> AccountingServers
        {
            get => _accountingServers ?? (_accountingServers = new InputList<Inputs.UserRadiusAccountingServerArgs>());
            set => _accountingServers = value;
        }

        /// <summary>
        /// Enable/disable sending of accounting messages to all configured servers (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("acctAllServers")]
        public Input<string>? AcctAllServers { get; set; }

        /// <summary>
        /// Time in seconds between each accounting interim update message.
        /// </summary>
        [Input("acctInterimInterval")]
        public Input<int>? AcctInterimInterval { get; set; }

        /// <summary>
        /// Enable/disable automatically including this RADIUS server in all user groups. Valid values: `disable`, `enable`.
        /// </summary>
        [Input("allUsergroup")]
        public Input<string>? AllUsergroup { get; set; }

        /// <summary>
        /// Authentication methods/protocols permitted for this RADIUS server. Valid values: `auto`, `ms_chap_v2`, `ms_chap`, `chap`, `pap`.
        /// </summary>
        [Input("authType")]
        public Input<string>? AuthType { get; set; }

        [Input("classes")]
        private InputList<Inputs.UserRadiusClassArgs>? _classes;

        /// <summary>
        /// Class attribute name(s). The structure of `class` block is documented below.
        /// </summary>
        public InputList<Inputs.UserRadiusClassArgs> Classes
        {
            get => _classes ?? (_classes = new InputList<Inputs.UserRadiusClassArgs>());
            set => _classes = value;
        }

        /// <summary>
        /// Configure delimiter to be used for separating profile group names in the SSO attribute (default = plus character "+"). Valid values: `plus`, `comma`.
        /// </summary>
        [Input("delimiter")]
        public Input<string>? Delimiter { get; set; }

        /// <summary>
        /// Sort sub-tables, please do not set this parameter when configuring static sub-tables. Options: [ false, true, natural, alphabetical ]. false: Default value, do not sort tables; true/natural: sort tables in natural order. For example: [ a10, a2 ] -&gt; [ a2, a10 ]; alphabetical: sort tables in alphabetical order. For example: [ a10, a2 ] -&gt; [ a10, a2 ].
        /// </summary>
        [Input("dynamicSortSubtable")]
        public Input<string>? DynamicSortSubtable { get; set; }

        /// <summary>
        /// RADIUS attribute type to override user group information. Valid values: `filter-Id`, `class`.
        /// </summary>
        [Input("groupOverrideAttrType")]
        public Input<string>? GroupOverrideAttrType { get; set; }

        /// <summary>
        /// Enable/disable compatibility with the H3C, a mechanism that performs security checking for authentication. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("h3cCompatibility")]
        public Input<string>? H3cCompatibility { get; set; }

        /// <summary>
        /// Specify outgoing interface to reach server.
        /// </summary>
        [Input("interface")]
        public Input<string>? Interface { get; set; }

        /// <summary>
        /// Specify how to select outgoing interface to reach server. Valid values: `auto`, `sdwan`, `specify`.
        /// </summary>
        [Input("interfaceSelectMethod")]
        public Input<string>? InterfaceSelectMethod { get; set; }

        /// <summary>
        /// MAC authentication case (default = lowercase). Valid values: `uppercase`, `lowercase`.
        /// </summary>
        [Input("macCase")]
        public Input<string>? MacCase { get; set; }

        /// <summary>
        /// MAC authentication password delimiter (default = hyphen). Valid values: `hyphen`, `single-hyphen`, `colon`, `none`.
        /// </summary>
        [Input("macPasswordDelimiter")]
        public Input<string>? MacPasswordDelimiter { get; set; }

        /// <summary>
        /// MAC authentication username delimiter (default = hyphen). Valid values: `hyphen`, `single-hyphen`, `colon`, `none`.
        /// </summary>
        [Input("macUsernameDelimiter")]
        public Input<string>? MacUsernameDelimiter { get; set; }

        /// <summary>
        /// RADIUS server entry name.
        /// </summary>
        [Input("name")]
        public Input<string>? Name { get; set; }

        /// <summary>
        /// IP address used to communicate with the RADIUS server and used as NAS-IP-Address and Called-Station-ID attributes.
        /// </summary>
        [Input("nasIp")]
        public Input<string>? NasIp { get; set; }

        /// <summary>
        /// Password encoding. Valid values: `auto`, `ISO-8859-1`.
        /// </summary>
        [Input("passwordEncoding")]
        public Input<string>? PasswordEncoding { get; set; }

        /// <summary>
        /// Enable/disable password renewal. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("passwordRenewal")]
        public Input<string>? PasswordRenewal { get; set; }

        /// <summary>
        /// Enable to allow a mechanism to change the attributes of an authentication, authorization, and accounting session after it is authenticated. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("radiusCoa")]
        public Input<string>? RadiusCoa { get; set; }

        /// <summary>
        /// RADIUS service port number.
        /// </summary>
        [Input("radiusPort")]
        public Input<int>? RadiusPort { get; set; }

        /// <summary>
        /// Enable/disable RADIUS based single sign on feature. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("rsso")]
        public Input<string>? Rsso { get; set; }

        /// <summary>
        /// Time in seconds before the logged out user is removed from the "user context list" of logged on users.
        /// </summary>
        [Input("rssoContextTimeout")]
        public Input<int>? RssoContextTimeout { get; set; }

        /// <summary>
        /// RADIUS attributes used to extract the user end point identifer from the RADIUS Start record. Valid values: `User-Name`, `NAS-IP-Address`, `Framed-IP-Address`, `Framed-IP-Netmask`, `Filter-Id`, `Login-IP-Host`, `Reply-Message`, `Callback-Number`, `Callback-Id`, `Framed-Route`, `Framed-IPX-Network`, `Class`, `Called-Station-Id`, `Calling-Station-Id`, `NAS-Identifier`, `Proxy-State`, `Login-LAT-Service`, `Login-LAT-Node`, `Login-LAT-Group`, `Framed-AppleTalk-Zone`, `Acct-Session-Id`, `Acct-Multi-Session-Id`.
        /// </summary>
        [Input("rssoEndpointAttribute")]
        public Input<string>? RssoEndpointAttribute { get; set; }

        /// <summary>
        /// RADIUS attributes used to block a user. Valid values: `User-Name`, `NAS-IP-Address`, `Framed-IP-Address`, `Framed-IP-Netmask`, `Filter-Id`, `Login-IP-Host`, `Reply-Message`, `Callback-Number`, `Callback-Id`, `Framed-Route`, `Framed-IPX-Network`, `Class`, `Called-Station-Id`, `Calling-Station-Id`, `NAS-Identifier`, `Proxy-State`, `Login-LAT-Service`, `Login-LAT-Node`, `Login-LAT-Group`, `Framed-AppleTalk-Zone`, `Acct-Session-Id`, `Acct-Multi-Session-Id`.
        /// </summary>
        [Input("rssoEndpointBlockAttribute")]
        public Input<string>? RssoEndpointBlockAttribute { get; set; }

        /// <summary>
        /// Enable/disable the replacement of old IP addresses with new ones for the same endpoint on RADIUS accounting Start messages. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("rssoEpOneIpOnly")]
        public Input<string>? RssoEpOneIpOnly { get; set; }

        /// <summary>
        /// Enable/disable flushing user IP sessions on RADIUS accounting Stop messages. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("rssoFlushIpSession")]
        public Input<string>? RssoFlushIpSession { get; set; }

        /// <summary>
        /// Events to log. Valid values: `protocol-error`, `profile-missing`, `accounting-stop-missed`, `accounting-event`, `endpoint-block`, `radiusd-other`, `none`.
        /// </summary>
        [Input("rssoLogFlags")]
        public Input<string>? RssoLogFlags { get; set; }

        /// <summary>
        /// Time interval in seconds that group event log messages will be generated for dynamic profile events.
        /// </summary>
        [Input("rssoLogPeriod")]
        public Input<int>? RssoLogPeriod { get; set; }

        /// <summary>
        /// Enable/disable sending RADIUS response packets after receiving Start and Stop records. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("rssoRadiusResponse")]
        public Input<string>? RssoRadiusResponse { get; set; }

        /// <summary>
        /// UDP port to listen on for RADIUS Start and Stop records.
        /// </summary>
        [Input("rssoRadiusServerPort")]
        public Input<int>? RssoRadiusServerPort { get; set; }

        [Input("rssoSecret")]
        private Input<string>? _rssoSecret;

        /// <summary>
        /// RADIUS secret used by the RADIUS accounting server.
        /// </summary>
        public Input<string>? RssoSecret
        {
            get => _rssoSecret;
            set
            {
                var emptySecret = Output.CreateSecret(0);
                _rssoSecret = Output.Tuple<Input<string>?, int>(value, emptySecret).Apply(t => t.Item1);
            }
        }

        /// <summary>
        /// Enable/disable validating the RADIUS request shared secret in the Start or End record. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("rssoValidateRequestSecret")]
        public Input<string>? RssoValidateRequestSecret { get; set; }

        [Input("secondarySecret")]
        private Input<string>? _secondarySecret;

        /// <summary>
        /// Secret key to access the secondary server.
        /// </summary>
        public Input<string>? SecondarySecret
        {
            get => _secondarySecret;
            set
            {
                var emptySecret = Output.CreateSecret(0);
                _secondarySecret = Output.Tuple<Input<string>?, int>(value, emptySecret).Apply(t => t.Item1);
            }
        }

        /// <summary>
        /// {&lt;name_str|ip_str&gt;} secondary RADIUS CN domain name or IP.
        /// </summary>
        [Input("secondaryServer")]
        public Input<string>? SecondaryServer { get; set; }

        [Input("secret")]
        private Input<string>? _secret;

        /// <summary>
        /// Pre-shared secret key used to access the primary RADIUS server.
        /// </summary>
        public Input<string>? Secret
        {
            get => _secret;
            set
            {
                var emptySecret = Output.CreateSecret(0);
                _secret = Output.Tuple<Input<string>?, int>(value, emptySecret).Apply(t => t.Item1);
            }
        }

        /// <summary>
        /// Primary RADIUS server CN domain name or IP address.
        /// </summary>
        [Input("server")]
        public Input<string>? Server { get; set; }

        /// <summary>
        /// Source IP address for communications to the RADIUS server.
        /// </summary>
        [Input("sourceIp")]
        public Input<string>? SourceIp { get; set; }

        /// <summary>
        /// RADIUS attribute that contains the profile group name to be extracted from the RADIUS Start record. Valid values: `User-Name`, `NAS-IP-Address`, `Framed-IP-Address`, `Framed-IP-Netmask`, `Filter-Id`, `Login-IP-Host`, `Reply-Message`, `Callback-Number`, `Callback-Id`, `Framed-Route`, `Framed-IPX-Network`, `Class`, `Called-Station-Id`, `Calling-Station-Id`, `NAS-Identifier`, `Proxy-State`, `Login-LAT-Service`, `Login-LAT-Node`, `Login-LAT-Group`, `Framed-AppleTalk-Zone`, `Acct-Session-Id`, `Acct-Multi-Session-Id`.
        /// </summary>
        [Input("ssoAttribute")]
        public Input<string>? SsoAttribute { get; set; }

        [Input("ssoAttributeKey")]
        private Input<string>? _ssoAttributeKey;

        /// <summary>
        /// Key prefix for SSO group value in the SSO attribute.
        /// </summary>
        public Input<string>? SsoAttributeKey
        {
            get => _ssoAttributeKey;
            set
            {
                var emptySecret = Output.CreateSecret(0);
                _ssoAttributeKey = Output.Tuple<Input<string>?, int>(value, emptySecret).Apply(t => t.Item1);
            }
        }

        /// <summary>
        /// Enable/disable override old attribute value with new value for the same endpoint. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("ssoAttributeValueOverride")]
        public Input<string>? SsoAttributeValueOverride { get; set; }

        /// <summary>
        /// Switch controller accounting message Framed-IP detection from DHCP snooping (seconds, default=2).
        /// </summary>
        [Input("switchControllerAcctFastFramedipDetect")]
        public Input<int>? SwitchControllerAcctFastFramedipDetect { get; set; }

        /// <summary>
        /// RADIUS service type. Valid values: `login`, `framed`, `callback-login`, `callback-framed`, `outbound`, `administrative`, `nas-prompt`, `authenticate-only`, `callback-nas-prompt`, `call-check`, `callback-administrative`.
        /// </summary>
        [Input("switchControllerServiceType")]
        public Input<string>? SwitchControllerServiceType { get; set; }

        [Input("tertiarySecret")]
        private Input<string>? _tertiarySecret;

        /// <summary>
        /// Secret key to access the tertiary server.
        /// </summary>
        public Input<string>? TertiarySecret
        {
            get => _tertiarySecret;
            set
            {
                var emptySecret = Output.CreateSecret(0);
                _tertiarySecret = Output.Tuple<Input<string>?, int>(value, emptySecret).Apply(t => t.Item1);
            }
        }

        /// <summary>
        /// {&lt;name_str|ip_str&gt;} tertiary RADIUS CN domain name or IP.
        /// </summary>
        [Input("tertiaryServer")]
        public Input<string>? TertiaryServer { get; set; }

        /// <summary>
        /// Time in seconds between re-sending authentication requests.
        /// </summary>
        [Input("timeout")]
        public Input<int>? Timeout { get; set; }

        /// <summary>
        /// Enable/disable using management VDOM to send requests. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("useManagementVdom")]
        public Input<string>? UseManagementVdom { get; set; }

        /// <summary>
        /// Enable/disable case sensitive user names. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("usernameCaseSensitive")]
        public Input<string>? UsernameCaseSensitive { get; set; }

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Input("vdomparam")]
        public Input<string>? Vdomparam { get; set; }

        public UserRadiusArgs()
        {
        }
        public static new UserRadiusArgs Empty => new UserRadiusArgs();
    }

    public sealed class UserRadiusState : global::Pulumi.ResourceArgs
    {
        [Input("accountingServers")]
        private InputList<Inputs.UserRadiusAccountingServerGetArgs>? _accountingServers;

        /// <summary>
        /// Additional accounting servers. The structure of `accounting_server` block is documented below.
        /// </summary>
        public InputList<Inputs.UserRadiusAccountingServerGetArgs> AccountingServers
        {
            get => _accountingServers ?? (_accountingServers = new InputList<Inputs.UserRadiusAccountingServerGetArgs>());
            set => _accountingServers = value;
        }

        /// <summary>
        /// Enable/disable sending of accounting messages to all configured servers (default = disable). Valid values: `enable`, `disable`.
        /// </summary>
        [Input("acctAllServers")]
        public Input<string>? AcctAllServers { get; set; }

        /// <summary>
        /// Time in seconds between each accounting interim update message.
        /// </summary>
        [Input("acctInterimInterval")]
        public Input<int>? AcctInterimInterval { get; set; }

        /// <summary>
        /// Enable/disable automatically including this RADIUS server in all user groups. Valid values: `disable`, `enable`.
        /// </summary>
        [Input("allUsergroup")]
        public Input<string>? AllUsergroup { get; set; }

        /// <summary>
        /// Authentication methods/protocols permitted for this RADIUS server. Valid values: `auto`, `ms_chap_v2`, `ms_chap`, `chap`, `pap`.
        /// </summary>
        [Input("authType")]
        public Input<string>? AuthType { get; set; }

        [Input("classes")]
        private InputList<Inputs.UserRadiusClassGetArgs>? _classes;

        /// <summary>
        /// Class attribute name(s). The structure of `class` block is documented below.
        /// </summary>
        public InputList<Inputs.UserRadiusClassGetArgs> Classes
        {
            get => _classes ?? (_classes = new InputList<Inputs.UserRadiusClassGetArgs>());
            set => _classes = value;
        }

        /// <summary>
        /// Configure delimiter to be used for separating profile group names in the SSO attribute (default = plus character "+"). Valid values: `plus`, `comma`.
        /// </summary>
        [Input("delimiter")]
        public Input<string>? Delimiter { get; set; }

        /// <summary>
        /// Sort sub-tables, please do not set this parameter when configuring static sub-tables. Options: [ false, true, natural, alphabetical ]. false: Default value, do not sort tables; true/natural: sort tables in natural order. For example: [ a10, a2 ] -&gt; [ a2, a10 ]; alphabetical: sort tables in alphabetical order. For example: [ a10, a2 ] -&gt; [ a10, a2 ].
        /// </summary>
        [Input("dynamicSortSubtable")]
        public Input<string>? DynamicSortSubtable { get; set; }

        /// <summary>
        /// RADIUS attribute type to override user group information. Valid values: `filter-Id`, `class`.
        /// </summary>
        [Input("groupOverrideAttrType")]
        public Input<string>? GroupOverrideAttrType { get; set; }

        /// <summary>
        /// Enable/disable compatibility with the H3C, a mechanism that performs security checking for authentication. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("h3cCompatibility")]
        public Input<string>? H3cCompatibility { get; set; }

        /// <summary>
        /// Specify outgoing interface to reach server.
        /// </summary>
        [Input("interface")]
        public Input<string>? Interface { get; set; }

        /// <summary>
        /// Specify how to select outgoing interface to reach server. Valid values: `auto`, `sdwan`, `specify`.
        /// </summary>
        [Input("interfaceSelectMethod")]
        public Input<string>? InterfaceSelectMethod { get; set; }

        /// <summary>
        /// MAC authentication case (default = lowercase). Valid values: `uppercase`, `lowercase`.
        /// </summary>
        [Input("macCase")]
        public Input<string>? MacCase { get; set; }

        /// <summary>
        /// MAC authentication password delimiter (default = hyphen). Valid values: `hyphen`, `single-hyphen`, `colon`, `none`.
        /// </summary>
        [Input("macPasswordDelimiter")]
        public Input<string>? MacPasswordDelimiter { get; set; }

        /// <summary>
        /// MAC authentication username delimiter (default = hyphen). Valid values: `hyphen`, `single-hyphen`, `colon`, `none`.
        /// </summary>
        [Input("macUsernameDelimiter")]
        public Input<string>? MacUsernameDelimiter { get; set; }

        /// <summary>
        /// RADIUS server entry name.
        /// </summary>
        [Input("name")]
        public Input<string>? Name { get; set; }

        /// <summary>
        /// IP address used to communicate with the RADIUS server and used as NAS-IP-Address and Called-Station-ID attributes.
        /// </summary>
        [Input("nasIp")]
        public Input<string>? NasIp { get; set; }

        /// <summary>
        /// Password encoding. Valid values: `auto`, `ISO-8859-1`.
        /// </summary>
        [Input("passwordEncoding")]
        public Input<string>? PasswordEncoding { get; set; }

        /// <summary>
        /// Enable/disable password renewal. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("passwordRenewal")]
        public Input<string>? PasswordRenewal { get; set; }

        /// <summary>
        /// Enable to allow a mechanism to change the attributes of an authentication, authorization, and accounting session after it is authenticated. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("radiusCoa")]
        public Input<string>? RadiusCoa { get; set; }

        /// <summary>
        /// RADIUS service port number.
        /// </summary>
        [Input("radiusPort")]
        public Input<int>? RadiusPort { get; set; }

        /// <summary>
        /// Enable/disable RADIUS based single sign on feature. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("rsso")]
        public Input<string>? Rsso { get; set; }

        /// <summary>
        /// Time in seconds before the logged out user is removed from the "user context list" of logged on users.
        /// </summary>
        [Input("rssoContextTimeout")]
        public Input<int>? RssoContextTimeout { get; set; }

        /// <summary>
        /// RADIUS attributes used to extract the user end point identifer from the RADIUS Start record. Valid values: `User-Name`, `NAS-IP-Address`, `Framed-IP-Address`, `Framed-IP-Netmask`, `Filter-Id`, `Login-IP-Host`, `Reply-Message`, `Callback-Number`, `Callback-Id`, `Framed-Route`, `Framed-IPX-Network`, `Class`, `Called-Station-Id`, `Calling-Station-Id`, `NAS-Identifier`, `Proxy-State`, `Login-LAT-Service`, `Login-LAT-Node`, `Login-LAT-Group`, `Framed-AppleTalk-Zone`, `Acct-Session-Id`, `Acct-Multi-Session-Id`.
        /// </summary>
        [Input("rssoEndpointAttribute")]
        public Input<string>? RssoEndpointAttribute { get; set; }

        /// <summary>
        /// RADIUS attributes used to block a user. Valid values: `User-Name`, `NAS-IP-Address`, `Framed-IP-Address`, `Framed-IP-Netmask`, `Filter-Id`, `Login-IP-Host`, `Reply-Message`, `Callback-Number`, `Callback-Id`, `Framed-Route`, `Framed-IPX-Network`, `Class`, `Called-Station-Id`, `Calling-Station-Id`, `NAS-Identifier`, `Proxy-State`, `Login-LAT-Service`, `Login-LAT-Node`, `Login-LAT-Group`, `Framed-AppleTalk-Zone`, `Acct-Session-Id`, `Acct-Multi-Session-Id`.
        /// </summary>
        [Input("rssoEndpointBlockAttribute")]
        public Input<string>? RssoEndpointBlockAttribute { get; set; }

        /// <summary>
        /// Enable/disable the replacement of old IP addresses with new ones for the same endpoint on RADIUS accounting Start messages. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("rssoEpOneIpOnly")]
        public Input<string>? RssoEpOneIpOnly { get; set; }

        /// <summary>
        /// Enable/disable flushing user IP sessions on RADIUS accounting Stop messages. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("rssoFlushIpSession")]
        public Input<string>? RssoFlushIpSession { get; set; }

        /// <summary>
        /// Events to log. Valid values: `protocol-error`, `profile-missing`, `accounting-stop-missed`, `accounting-event`, `endpoint-block`, `radiusd-other`, `none`.
        /// </summary>
        [Input("rssoLogFlags")]
        public Input<string>? RssoLogFlags { get; set; }

        /// <summary>
        /// Time interval in seconds that group event log messages will be generated for dynamic profile events.
        /// </summary>
        [Input("rssoLogPeriod")]
        public Input<int>? RssoLogPeriod { get; set; }

        /// <summary>
        /// Enable/disable sending RADIUS response packets after receiving Start and Stop records. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("rssoRadiusResponse")]
        public Input<string>? RssoRadiusResponse { get; set; }

        /// <summary>
        /// UDP port to listen on for RADIUS Start and Stop records.
        /// </summary>
        [Input("rssoRadiusServerPort")]
        public Input<int>? RssoRadiusServerPort { get; set; }

        [Input("rssoSecret")]
        private Input<string>? _rssoSecret;

        /// <summary>
        /// RADIUS secret used by the RADIUS accounting server.
        /// </summary>
        public Input<string>? RssoSecret
        {
            get => _rssoSecret;
            set
            {
                var emptySecret = Output.CreateSecret(0);
                _rssoSecret = Output.Tuple<Input<string>?, int>(value, emptySecret).Apply(t => t.Item1);
            }
        }

        /// <summary>
        /// Enable/disable validating the RADIUS request shared secret in the Start or End record. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("rssoValidateRequestSecret")]
        public Input<string>? RssoValidateRequestSecret { get; set; }

        [Input("secondarySecret")]
        private Input<string>? _secondarySecret;

        /// <summary>
        /// Secret key to access the secondary server.
        /// </summary>
        public Input<string>? SecondarySecret
        {
            get => _secondarySecret;
            set
            {
                var emptySecret = Output.CreateSecret(0);
                _secondarySecret = Output.Tuple<Input<string>?, int>(value, emptySecret).Apply(t => t.Item1);
            }
        }

        /// <summary>
        /// {&lt;name_str|ip_str&gt;} secondary RADIUS CN domain name or IP.
        /// </summary>
        [Input("secondaryServer")]
        public Input<string>? SecondaryServer { get; set; }

        [Input("secret")]
        private Input<string>? _secret;

        /// <summary>
        /// Pre-shared secret key used to access the primary RADIUS server.
        /// </summary>
        public Input<string>? Secret
        {
            get => _secret;
            set
            {
                var emptySecret = Output.CreateSecret(0);
                _secret = Output.Tuple<Input<string>?, int>(value, emptySecret).Apply(t => t.Item1);
            }
        }

        /// <summary>
        /// Primary RADIUS server CN domain name or IP address.
        /// </summary>
        [Input("server")]
        public Input<string>? Server { get; set; }

        /// <summary>
        /// Source IP address for communications to the RADIUS server.
        /// </summary>
        [Input("sourceIp")]
        public Input<string>? SourceIp { get; set; }

        /// <summary>
        /// RADIUS attribute that contains the profile group name to be extracted from the RADIUS Start record. Valid values: `User-Name`, `NAS-IP-Address`, `Framed-IP-Address`, `Framed-IP-Netmask`, `Filter-Id`, `Login-IP-Host`, `Reply-Message`, `Callback-Number`, `Callback-Id`, `Framed-Route`, `Framed-IPX-Network`, `Class`, `Called-Station-Id`, `Calling-Station-Id`, `NAS-Identifier`, `Proxy-State`, `Login-LAT-Service`, `Login-LAT-Node`, `Login-LAT-Group`, `Framed-AppleTalk-Zone`, `Acct-Session-Id`, `Acct-Multi-Session-Id`.
        /// </summary>
        [Input("ssoAttribute")]
        public Input<string>? SsoAttribute { get; set; }

        [Input("ssoAttributeKey")]
        private Input<string>? _ssoAttributeKey;

        /// <summary>
        /// Key prefix for SSO group value in the SSO attribute.
        /// </summary>
        public Input<string>? SsoAttributeKey
        {
            get => _ssoAttributeKey;
            set
            {
                var emptySecret = Output.CreateSecret(0);
                _ssoAttributeKey = Output.Tuple<Input<string>?, int>(value, emptySecret).Apply(t => t.Item1);
            }
        }

        /// <summary>
        /// Enable/disable override old attribute value with new value for the same endpoint. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("ssoAttributeValueOverride")]
        public Input<string>? SsoAttributeValueOverride { get; set; }

        /// <summary>
        /// Switch controller accounting message Framed-IP detection from DHCP snooping (seconds, default=2).
        /// </summary>
        [Input("switchControllerAcctFastFramedipDetect")]
        public Input<int>? SwitchControllerAcctFastFramedipDetect { get; set; }

        /// <summary>
        /// RADIUS service type. Valid values: `login`, `framed`, `callback-login`, `callback-framed`, `outbound`, `administrative`, `nas-prompt`, `authenticate-only`, `callback-nas-prompt`, `call-check`, `callback-administrative`.
        /// </summary>
        [Input("switchControllerServiceType")]
        public Input<string>? SwitchControllerServiceType { get; set; }

        [Input("tertiarySecret")]
        private Input<string>? _tertiarySecret;

        /// <summary>
        /// Secret key to access the tertiary server.
        /// </summary>
        public Input<string>? TertiarySecret
        {
            get => _tertiarySecret;
            set
            {
                var emptySecret = Output.CreateSecret(0);
                _tertiarySecret = Output.Tuple<Input<string>?, int>(value, emptySecret).Apply(t => t.Item1);
            }
        }

        /// <summary>
        /// {&lt;name_str|ip_str&gt;} tertiary RADIUS CN domain name or IP.
        /// </summary>
        [Input("tertiaryServer")]
        public Input<string>? TertiaryServer { get; set; }

        /// <summary>
        /// Time in seconds between re-sending authentication requests.
        /// </summary>
        [Input("timeout")]
        public Input<int>? Timeout { get; set; }

        /// <summary>
        /// Enable/disable using management VDOM to send requests. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("useManagementVdom")]
        public Input<string>? UseManagementVdom { get; set; }

        /// <summary>
        /// Enable/disable case sensitive user names. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("usernameCaseSensitive")]
        public Input<string>? UsernameCaseSensitive { get; set; }

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Input("vdomparam")]
        public Input<string>? Vdomparam { get; set; }

        public UserRadiusState()
        {
        }
        public static new UserRadiusState Empty => new UserRadiusState();
    }
}
