vmware.vmware_rest.appliance_localaccounts_globalpolicy module – Manage the global password policy for local accounts on the vCenter Server Appliance.

Note

This module is part of the vmware.vmware_rest collection (version 5.0.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install vmware.vmware_rest.

To use it in a playbook, specify: vmware.vmware_rest.appliance_localaccounts_globalpolicy.

New in vmware.vmware_rest 5.0.0

Synopsis

  • Update the global password policy that applies to local accounts on the vCenter Server Appliance.

  • The policy controls password aging (maximum, minimum, and warning days), password complexity requirements, and account lockout behavior.

  • Changes apply to both new and existing local accounts. To change the policy for a single account, use the per-account local-accounts API instead.

Parameters

Parameter

Comments

fail_interval_between_attempts

integer

The length of the interval during which the consecutive authentication failures must happen for the user account lock out

This property was added in vSphere API 9.1.0.0.

failed_attempt_count_before_account_lockout

integer

Threshold Number of consecutive authentication failures for the user during the recent interval before the account is locked out.

This property was added in vSphere API 9.1.0.0.

length_of_lockout_period_in_seconds

integer

The access will be reenabled after n seconds after the lock out.

This property was added in vSphere API 9.1.0.0.

managed_at_fleet

boolean

Whether the password policy is managed at fleet or not.

This property was added in vSphere API 9.1.0.0.

Choices:

  • false

  • true

max_days

integer

Maximum number of days a password may be used. If the password is older than this, a password change will be forced.

This property was added in vSphere API 6.7.

min_days

integer

Minimum number of days allowed between password changes. Any password changes attempted sooner than this will be rejected.

This property was added in vSphere API 6.7.

minimum_length

integer

Minimum number of the characters needed in the password.

This property was added in vSphere API 9.1.0.0.

minimum_lowercase_char_count

integer

Minimum number of lower case characters needed in the password.

This property was added in vSphere API 9.1.0.0.

minimum_numerics_char_count

integer

Minimum number of numeric characters needed in the password.

This property was added in vSphere API 9.1.0.0.

minimum_special_char_count

integer

Minimum number of special characters needed in the password.

This property was added in vSphere API 9.1.0.0.

minimum_uppercase_char_count

integer

Minimum number of upper case characters needed in the password.

This property was added in vSphere API 9.1.0.0.

prior_password_remember_count

integer

The number of prior passwords for the user to be remembered by the vCenter appliance in order for the appliance to assess non-repetition.

This property was added in vSphere API 9.1.0.0.

session_timeout

float

Timeout in seconds for the whole operation including connection establishment, request sending, and response.

Default: 300.0

state

string

The desired state of the global password policy.

Use present to update the policy with the supplied values.

Choices:

  • "present" ← (default)

vcenter_hostname

string / required

The hostname or IP address of the vSphere vCenter.

If the value is not specified in the task, the value of environment variable VMWARE_HOST will be used instead.

vcenter_password

string / required

The vSphere vCenter password.

If the value is not specified in the task, the value of environment variable VMWARE_PASSWORD will be used instead.

vcenter_port

integer

The port number of the vSphere vCenter.

If the value is not specified in the task, the value of environment variable VMWARE_PORT will be used instead.

vcenter_rest_log_file

string

Optional path to a log file for HTTP REST interaction.

If the value is not specified in the task, the value of environment variable VMWARE_REST_LOG_FILE will be used instead.

vcenter_username

string / required

The vSphere vCenter username.

If the value is not specified in the task, the value of environment variable VMWARE_USER will be used instead.

vcenter_validate_certs

boolean

Allows connection when SSL certificates are not valid.

Set to false when certificates are not trusted.

If the value is not specified in the task, the value of environment variable VMWARE_VALIDATE_CERTS will be used instead.

Choices:

  • false

  • true ← (default)

warn_days

integer

Number of days warning given before a password expires. A zero means warning is given only upon the day of expiration.

This property was added in vSphere API 6.7.

Notes

Note

  • Generated from vSphere API spec 9.1.0.

  • Not compatible with vSphere API 7.0.3.

  • Not compatible with vSphere API 8.0.2.

Examples

- name: Set basic password aging policy
  vmware.vmware_rest.appliance_localaccounts_globalpolicy:
    max_days: 90
    min_days: 1
    warn_days: 7

- name: Enforce password complexity and account lockout policy
  vmware.vmware_rest.appliance_localaccounts_globalpolicy:
    max_days: 60
    min_days: 1
    warn_days: 14
    minimum_length: 12
    minimum_uppercase_char_count: 1
    minimum_lowercase_char_count: 1
    minimum_numerics_char_count: 1
    minimum_special_char_count: 1
    prior_password_remember_count: 5
    failed_attempt_count_before_account_lockout: 3
    fail_interval_between_attempts: 900
    length_of_lockout_period_in_seconds: 1800

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

value

any

The raw API response body from the vCenter operation.

Returned: On success

Sample: {}

Authors

  • Ansible Eco Content Team (@eco-ansible-content)