cisco-ise 1.0.0

package/cli/commands/endpoint.js

@@ -0,0 +1,167 @@
+const fs = require("fs");
+const { parse } = require("csv-parse/sync");
+const { resolveConnection } = require("../utils/connection.js");
+const { printResult, printError, printDryRun } = require("../utils/output.js");
+const { checkWriteAllowed } = require("../utils/confirm.js");
+const { normalizeMac } = require("../utils/mac.js");
+const audit = require("../utils/audit.js");
+const IseClient = require("../utils/api.js");
+
+async function resolveGroupId(client, groupName) {
+  const data = await client.ersGet("/endpointgroup", { size: 100 });
+  const groups = data?.SearchResult?.resources || [];
+  const match = groups.find((g) => g.name.toLowerCase() === groupName.toLowerCase());
+  if (!match) throw new Error(`Identity group "${groupName}" not found. Run: cisco-ise identity-group list`);
+  return match.id;
+}
+
+async function findEndpointByMac(client, mac) {
+  const normalized = normalizeMac(mac);
+  const data = await client.ersGet(`/endpoint`, { filter: `mac.EQ.${normalized}`, size: 1 });
+  const resources = data?.SearchResult?.resources;
+  if (!resources?.length) throw new Error(`Endpoint with MAC ${normalized} not found.`);
+  const detail = await client.ersGet(`/endpoint/${resources[0].id}`);
+  return detail?.ERSEndPoint || detail;
+}
+
+module.exports = function (program) {
+  const cmd = program.command("endpoint").description("Manage ISE endpoints");
+
+  cmd.command("list")
+    .description("List all endpoints")
+    .option("--limit <n>", "max results", parseInt)
+    .option("--page <n>", "specific page", parseInt)
+    .option("--page-size <n>", "results per page", parseInt)
+    .action(async (opts, command) => {
+      try {
+        const globalOpts = command.optsWithGlobals();
+        const conn = resolveConnection(globalOpts);
+        const client = new IseClient(conn, { noCache: !globalOpts.cache, debug: globalOpts.debug });
+
+        const resources = await client.ersPaginateAll("/endpoint", {}, {
+          limit: opts.limit,
+          page: opts.page,
+          pageSize: opts.pageSize,
+        });
+        await printResult(resources, globalOpts.format);
+      } catch (err) { printError(err); }
+    });
+
+  cmd.command("search")
+    .description("Search endpoints")
+    .option("--mac <mac>", "search by MAC address")
+    .option("--group <name>", "filter by identity group name")
+    .action(async (opts, command) => {
+      try {
+        const globalOpts = command.optsWithGlobals();
+        const conn = resolveConnection(globalOpts);
+        const client = new IseClient(conn, { noCache: !globalOpts.cache, debug: globalOpts.debug });
+
+        const params = {};
+        const filters = [];
+        if (opts.mac) filters.push(`mac.EQ.${normalizeMac(opts.mac)}`);
+        if (opts.group) {
+          const groupId = await resolveGroupId(client, opts.group);
+          filters.push(`groupId.EQ.${groupId}`);
+        }
+        if (filters.length) params.filter = filters.join(",");
+
+        const resources = await client.ersPaginateAll("/endpoint", params);
+        await printResult(resources, globalOpts.format);
+      } catch (err) { printError(err); }
+    });
+
+  cmd.command("add")
+    .description("Add an endpoint")
+    .option("--mac <mac>", "MAC address")
+    .option("--group <name>", "identity group name")
+    .option("--description <desc>", "endpoint description")
+    .option("--csv <file>", "bulk import from CSV (columns: mac, group, description)")
+    .action(async (opts, command) => {
+      try {
+        const globalOpts = command.optsWithGlobals();
+        const conn = resolveConnection(globalOpts);
+        await checkWriteAllowed(conn, globalOpts);
+        const client = new IseClient(conn, {
+          noCache: !globalOpts.cache, debug: globalOpts.debug, dryRun: globalOpts.dryRun,
+        });
+
+        if (opts.csv) {
+          const content = fs.readFileSync(opts.csv, "utf8");
+          const records = parse(content, { columns: true, skip_empty_lines: true });
+          const results = [];
+          for (const record of records) {
+            const mac = normalizeMac(record.mac);
+            const body = { ERSEndPoint: { mac, description: record.description || "" } };
+            if (record.group) {
+              body.ERSEndPoint.groupId = await resolveGroupId(client, record.group);
+            }
+            const result = await client.ersPost("/endpoint", body);
+            if (result.dryRun) { printDryRun(result); }
+            else { results.push({ mac, status: "created" }); }
+          }
+          if (results.length) {
+            if (globalOpts.audit !== false) audit.log({ command: "endpoint add (csv)", count: results.length });
+            await printResult(results, globalOpts.format);
+          }
+          return;
+        }
+
+        if (!opts.mac) throw new Error("--mac is required (or use --csv for bulk import)");
+        const mac = normalizeMac(opts.mac);
+        const body = { ERSEndPoint: { mac, description: opts.description || "" } };
+        if (opts.group) {
+          body.ERSEndPoint.groupId = await resolveGroupId(client, opts.group);
+        }
+        const result = await client.ersPost("/endpoint", body);
+        if (result.dryRun) { printDryRun(result); return; }
+        if (globalOpts.audit !== false) audit.log({ command: "endpoint add", mac });
+        console.log(`Endpoint ${mac} created.`);
+      } catch (err) { printError(err); }
+    });
+
+  cmd.command("update <mac>")
+    .description("Update an endpoint")
+    .option("--group <name>", "new identity group")
+    .option("--description <desc>", "new description")
+    .action(async (mac, opts, command) => {
+      try {
+        const globalOpts = command.optsWithGlobals();
+        const conn = resolveConnection(globalOpts);
+        await checkWriteAllowed(conn, globalOpts);
+        const client = new IseClient(conn, {
+          noCache: !globalOpts.cache, debug: globalOpts.debug, dryRun: globalOpts.dryRun,
+        });
+
+        const existing = await findEndpointByMac(client, mac);
+        const body = { ERSEndPoint: { ...existing } };
+        if (opts.description !== undefined) body.ERSEndPoint.description = opts.description;
+        if (opts.group) {
+          body.ERSEndPoint.groupId = await resolveGroupId(client, opts.group);
+        }
+        const result = await client.ersPut(`/endpoint/${existing.id}`, body);
+        if (result.dryRun) { printDryRun(result); return; }
+        if (globalOpts.audit !== false) audit.log({ command: "endpoint update", mac: normalizeMac(mac) });
+        console.log(`Endpoint ${normalizeMac(mac)} updated.`);
+      } catch (err) { printError(err); }
+    });
+
+  cmd.command("delete <mac>")
+    .description("Delete an endpoint")
+    .action(async (mac, opts, command) => {
+      try {
+        const globalOpts = command.optsWithGlobals();
+        const conn = resolveConnection(globalOpts);
+        await checkWriteAllowed(conn, globalOpts);
+        const client = new IseClient(conn, {
+          noCache: !globalOpts.cache, debug: globalOpts.debug, dryRun: globalOpts.dryRun,
+        });
+
+        const existing = await findEndpointByMac(client, mac);
+        const result = await client.ersDelete(`/endpoint/${existing.id}`);
+        if (result.dryRun) { printDryRun(result); return; }
+        if (globalOpts.audit !== false) audit.log({ command: "endpoint delete", mac: normalizeMac(mac) });
+        console.log(`Endpoint ${normalizeMac(mac)} deleted.`);
+      } catch (err) { printError(err); }
+    });
+};

package/cli/commands/guest.js

@@ -0,0 +1,220 @@
+const fs = require("fs");
+const { parse } = require("csv-parse/sync");
+const { resolveConnection } = require("../utils/connection.js");
+const { printResult, printError, printDryRun } = require("../utils/output.js");
+const { checkWriteAllowed } = require("../utils/confirm.js");
+const { parseDuration } = require("../utils/time.js");
+const audit = require("../utils/audit.js");
+const IseClient = require("../utils/api.js");
+
+async function resolveSponsorPortalId(client) {
+  const data = await client.ersGet("/sponsorportal", { size: 100 });
+  const portals = data?.SearchResult?.resources || [];
+  if (!portals.length) throw new Error("No sponsor portals found.");
+  return portals[0].id;
+}
+
+module.exports = function (program) {
+  const cmd = program.command("guest").description("Manage ISE guest users");
+
+  cmd.command("list")
+    .description("List guest users")
+    .option("--limit <n>", "max results", parseInt)
+    .action(async (opts, command) => {
+      try {
+        const globalOpts = command.optsWithGlobals();
+        const conn = resolveConnection(globalOpts);
+        const client = new IseClient(conn, { noCache: !globalOpts.cache, debug: globalOpts.debug });
+
+        const resources = await client.sponsorPaginateAll("/guestuser", {}, { limit: opts.limit });
+        await printResult(resources, globalOpts.format);
+      } catch (err) { printError(err); }
+    });
+
+  cmd.command("search")
+    .description("Search guest users")
+    .option("--name <name>", "search by name")
+    .option("--status <status>", "filter by status (ACTIVE, SUSPENDED, etc.)")
+    .action(async (opts, command) => {
+      try {
+        const globalOpts = command.optsWithGlobals();
+        const conn = resolveConnection(globalOpts);
+        const client = new IseClient(conn, { noCache: !globalOpts.cache, debug: globalOpts.debug });
+
+        const filters = [];
+        if (opts.name) filters.push(`name.CONTAINS.${opts.name}`);
+        if (opts.status) filters.push(`status.EQ.${opts.status}`);
+        const params = filters.length ? { filter: filters.join(",") } : {};
+
+        const resources = await client.sponsorPaginateAll("/guestuser", params);
+        await printResult(resources, globalOpts.format);
+      } catch (err) { printError(err); }
+    });
+
+  cmd.command("create")
+    .description("Create a guest user")
+    .option("--first <name>", "first name")
+    .option("--last <name>", "last name")
+    .option("--email <email>", "email address")
+    .option("--portal <name>", "guest portal name")
+    .option("--duration <duration>", "account duration (e.g., 1d, 8h)")
+    .option("--csv <file>", "bulk create from CSV (columns: first, last, email, portal, duration)")
+    .action(async (opts, command) => {
+      try {
+        const globalOpts = command.optsWithGlobals();
+        const conn = resolveConnection(globalOpts);
+        await checkWriteAllowed(conn, globalOpts);
+        const client = new IseClient(conn, {
+          noCache: !globalOpts.cache, debug: globalOpts.debug, dryRun: globalOpts.dryRun,
+        });
+
+        if (opts.csv) {
+          const content = fs.readFileSync(opts.csv, "utf8");
+          const records = parse(content, { columns: true, skip_empty_lines: true });
+          const results = [];
+          for (const record of records) {
+            const portalId = await resolvePortalId(client, record.portal || "Sponsored Guest Portal (default)");
+            const body = {
+              GuestUser: {
+                guestType: "Contractor (default)",
+                portalId,
+                guestInfo: {
+                  firstName: record.first,
+                  lastName: record.last,
+                  emailAddress: record.email,
+                },
+              },
+            };
+            const result = await client.sponsorPost("/guestuser", body);
+            if (result.dryRun) { printDryRun(result); }
+            else { results.push({ name: `${record.first} ${record.last}`, status: "created" }); }
+          }
+          if (results.length) {
+            if (globalOpts.audit !== false) audit.log({ command: "guest create (csv)", count: results.length });
+            await printResult(results, globalOpts.format);
+          }
+          return;
+        }
+
+        if (!opts.first || !opts.last) throw new Error("--first and --last are required");
+        const portalId = await resolveSponsorPortalId(client);
+        const now = new Date();
+        const end = new Date(now.getTime() + (opts.duration ? parseDuration(opts.duration) : 24 * 60 * 60 * 1000));
+        const fmt = (d) => `${d.getMonth()+1}/${d.getDate()}/${d.getFullYear()} ${String(d.getHours()).padStart(2,"0")}:${String(d.getMinutes()).padStart(2,"0")}`;
+        const body = {
+          GuestUser: {
+            guestType: "Contractor (default)",
+            portalId,
+            guestInfo: {
+              userName: `${opts.first.toLowerCase()}_${opts.last.toLowerCase()}`,
+              firstName: opts.first,
+              lastName: opts.last,
+              emailAddress: opts.email || "",
+              password: "G" + Math.random().toString(36).slice(2, 6) + Math.floor(Math.random() * 900 + 100) + "!Aa",
+            },
+            guestAccessInfo: {
+              validDays: 1,
+              fromDate: fmt(now),
+              toDate: fmt(end),
+              location: "San Jose",
+            },
+          },
+        };
+        const result = await client.sponsorPost("/guestuser", body);
+        if (result.dryRun) { printDryRun(result); return; }
+        if (globalOpts.audit !== false) audit.log({ command: "guest create", name: `${opts.first} ${opts.last}` });
+        console.log(`Guest user "${opts.first} ${opts.last}" created (username: ${body.GuestUser.guestInfo.userName}, password: ${body.GuestUser.guestInfo.password}).`);
+      } catch (err) {
+        if (err.response?.data) process.stderr.write(JSON.stringify(err.response.data, null, 2) + "\n");
+        printError(err);
+      }
+    });
+
+  cmd.command("extend <id>")
+    .description("Extend guest account duration")
+    .option("--duration <duration>", "extension duration (e.g., 1d, 8h)", "1d")
+    .action(async (id, opts, command) => {
+      try {
+        const globalOpts = command.optsWithGlobals();
+        const conn = resolveConnection(globalOpts);
+        await checkWriteAllowed(conn, globalOpts);
+        const client = new IseClient(conn, {
+          noCache: !globalOpts.cache, debug: globalOpts.debug, dryRun: globalOpts.dryRun,
+        });
+
+        const ms = parseDuration(opts.duration);
+        const hours = Math.ceil(ms / (60 * 60 * 1000));
+        const result = await client.sponsorPut(`/guestuser/resetpassword/${id}`, {});
+        if (result.dryRun) { printDryRun(result); return; }
+        if (globalOpts.audit !== false) audit.log({ command: "guest extend", id, duration: opts.duration });
+        console.log(`Guest user ${id} extended by ${hours} hours.`);
+      } catch (err) { printError(err); }
+    });
+
+  cmd.command("suspend <id>")
+    .description("Suspend a guest user")
+    .action(async (id, opts, command) => {
+      try {
+        const globalOpts = command.optsWithGlobals();
+        const conn = resolveConnection(globalOpts);
+        await checkWriteAllowed(conn, globalOpts);
+        const client = new IseClient(conn, {
+          noCache: !globalOpts.cache, debug: globalOpts.debug, dryRun: globalOpts.dryRun,
+        });
+
+        const result = await client.sponsorPut(`/guestuser/suspend/name/${id}`, {});
+        if (result.dryRun) { printDryRun(result); return; }
+        if (globalOpts.audit !== false) audit.log({ command: "guest suspend", id });
+        console.log(`Guest user ${id} suspended.`);
+      } catch (err) { printError(err); }
+    });
+
+  cmd.command("reinstate <id>")
+    .description("Reinstate a suspended guest user")
+    .action(async (id, opts, command) => {
+      try {
+        const globalOpts = command.optsWithGlobals();
+        const conn = resolveConnection(globalOpts);
+        await checkWriteAllowed(conn, globalOpts);
+        const client = new IseClient(conn, {
+          noCache: !globalOpts.cache, debug: globalOpts.debug, dryRun: globalOpts.dryRun,
+        });
+
+        const result = await client.sponsorPut(`/guestuser/reinstate/name/${id}`, {});
+        if (result.dryRun) { printDryRun(result); return; }
+        if (globalOpts.audit !== false) audit.log({ command: "guest reinstate", id });
+        console.log(`Guest user ${id} reinstated.`);
+      } catch (err) { printError(err); }
+    });
+
+  cmd.command("delete <id>")
+    .description("Delete a guest user")
+    .action(async (id, opts, command) => {
+      try {
+        const globalOpts = command.optsWithGlobals();
+        const conn = resolveConnection(globalOpts);
+        await checkWriteAllowed(conn, globalOpts);
+        const client = new IseClient(conn, {
+          noCache: !globalOpts.cache, debug: globalOpts.debug, dryRun: globalOpts.dryRun,
+        });
+
+        const result = await client.sponsorDelete(`/guestuser/${id}`);
+        if (result.dryRun) { printDryRun(result); return; }
+        if (globalOpts.audit !== false) audit.log({ command: "guest delete", id });
+        console.log(`Guest user ${id} deleted.`);
+      } catch (err) { printError(err); }
+    });
+
+  cmd.command("portals")
+    .description("List available guest portals")
+    .action(async (opts, command) => {
+      try {
+        const globalOpts = command.optsWithGlobals();
+        const conn = resolveConnection(globalOpts);
+        const client = new IseClient(conn, { noCache: !globalOpts.cache, debug: globalOpts.debug });
+
+        const resources = await client.ersPaginateAll("/portal");
+        await printResult(resources, globalOpts.format);
+      } catch (err) { printError(err); }
+    });
+};

package/cli/commands/identity-group.js

@@ -0,0 +1,24 @@
+const { resolveConnection } = require("../utils/connection.js");
+const { printResult, printError } = require("../utils/output.js");
+const IseClient = require("../utils/api.js");
+
+module.exports = function (program) {
+  const cmd = program.command("identity-group").description("List ISE identity groups");
+
+  cmd.command("list")
+    .description("List identity groups")
+    .option("--type <type>", "filter by type (endpoint, user)")
+    .action(async (opts, command) => {
+      try {
+        const globalOpts = command.optsWithGlobals();
+        const conn = resolveConnection(globalOpts);
+        const client = new IseClient(conn, { noCache: !globalOpts.cache, debug: globalOpts.debug });
+
+        let endpoint = "/endpointgroup";
+        if (opts.type === "user") endpoint = "/identitygroup";
+
+        const resources = await client.ersPaginateAll(endpoint);
+        await printResult(resources, globalOpts.format);
+      } catch (err) { printError(err); }
+    });
+};

package/cli/commands/internal-user.js

@@ -0,0 +1,162 @@
+const { resolveConnection } = require("../utils/connection.js");
+const { printResult, printError, printDryRun } = require("../utils/output.js");
+const { checkWriteAllowed } = require("../utils/confirm.js");
+const audit = require("../utils/audit.js");
+const IseClient = require("../utils/api.js");
+
+async function resolveGroupId(client, groupName) {
+  const data = await client.ersGet("/identitygroup", { size: 100 });
+  const groups = data?.SearchResult?.resources || [];
+  const match = groups.find((g) => g.name.toLowerCase() === groupName.toLowerCase());
+  if (!match) throw new Error(`Identity group "${groupName}" not found. Run: cisco-ise identity-group list --type user`);
+  return match.id;
+}
+
+async function findUserByName(client, name) {
+  const data = await client.ersGet("/internaluser", { filter: `name.EQ.${name}`, size: 1 });
+  const resources = data?.SearchResult?.resources;
+  if (!resources?.length) throw new Error(`Internal user "${name}" not found.`);
+  const detail = await client.ersGet(`/internaluser/${resources[0].id}`);
+  return detail?.InternalUser || detail;
+}
+
+module.exports = function (program) {
+  const cmd = program.command("internal-user").description("Manage ISE internal users");
+
+  cmd.command("list")
+    .description("List internal users")
+    .option("--limit <n>", "max results", parseInt)
+    .action(async (opts, command) => {
+      try {
+        const globalOpts = command.optsWithGlobals();
+        const conn = resolveConnection(globalOpts);
+        const client = new IseClient(conn, { noCache: !globalOpts.cache, debug: globalOpts.debug });
+
+        const resources = await client.ersPaginateAll("/internaluser", {}, { limit: opts.limit });
+        await printResult(resources, globalOpts.format);
+      } catch (err) { printError(err); }
+    });
+
+  cmd.command("get <name>")
+    .description("Get internal user details")
+    .action(async (name, opts, command) => {
+      try {
+        const globalOpts = command.optsWithGlobals();
+        const conn = resolveConnection(globalOpts);
+        const client = new IseClient(conn, { noCache: !globalOpts.cache, debug: globalOpts.debug });
+
+        const user = await findUserByName(client, name);
+        const { link, ...clean } = user;
+        await printResult(clean, globalOpts.format);
+      } catch (err) { printError(err); }
+    });
+
+  cmd.command("add")
+    .description("Create an internal user")
+    .option("--user-name <name>", "username")
+    .option("--user-password <pass>", "user password")
+    .option("--email <email>", "email address")
+    .option("--first <name>", "first name")
+    .option("--last <name>", "last name")
+    .option("--group <name>", "identity group name")
+    .option("--description <desc>", "user description")
+    .action(async (opts, command) => {
+      try {
+        const globalOpts = command.optsWithGlobals();
+        const conn = resolveConnection(globalOpts);
+        await checkWriteAllowed(conn, globalOpts);
+        const client = new IseClient(conn, {
+          noCache: !globalOpts.cache, debug: globalOpts.debug, dryRun: globalOpts.dryRun,
+        });
+
+        if (!opts.userName) throw new Error("--user-name is required");
+        if (!opts.userPassword) throw new Error("--user-password is required");
+
+        const body = {
+          InternalUser: {
+            name: opts.userName,
+            password: opts.userPassword,
+            enabled: true,
+            changePassword: false,
+            description: opts.description || "",
+          },
+        };
+        if (opts.email) body.InternalUser.email = opts.email;
+        if (opts.first) body.InternalUser.firstName = opts.first;
+        if (opts.last) body.InternalUser.lastName = opts.last;
+        if (opts.group) {
+          body.InternalUser.identityGroups = await resolveGroupId(client, opts.group);
+        }
+
+        const result = await client.ersPost("/internaluser", body);
+        if (result.dryRun) { printDryRun(result); return; }
+        if (globalOpts.audit !== false) audit.log({ command: "internal-user add", name: opts.userName });
+        console.log(`Internal user "${opts.userName}" created.`);
+      } catch (err) { printError(err); }
+    });
+
+  cmd.command("update <name>")
+    .description("Update an internal user")
+    .option("--user-password <pass>", "new password")
+    .option("--email <email>", "email address")
+    .option("--first <name>", "first name")
+    .option("--last <name>", "last name")
+    .option("--group <name>", "identity group name")
+    .option("--description <desc>", "description")
+    .option("--enable", "enable the user")
+    .option("--disable", "disable the user")
+    .action(async (name, opts, command) => {
+      try {
+        const globalOpts = command.optsWithGlobals();
+        const conn = resolveConnection(globalOpts);
+        await checkWriteAllowed(conn, globalOpts);
+        const client = new IseClient(conn, {
+          noCache: !globalOpts.cache, debug: globalOpts.debug, dryRun: globalOpts.dryRun,
+        });
+
+        const existing = await findUserByName(client, name);
+        const body = {
+          InternalUser: {
+            id: existing.id,
+            name: existing.name,
+            enabled: existing.enabled,
+          },
+        };
+
+        if (opts.userPassword) body.InternalUser.password = opts.userPassword;
+        if (opts.email) body.InternalUser.email = opts.email;
+        if (opts.first) body.InternalUser.firstName = opts.first;
+        if (opts.last) body.InternalUser.lastName = opts.last;
+        if (opts.description !== undefined) body.InternalUser.description = opts.description;
+        if (opts.enable) body.InternalUser.enabled = true;
+        if (opts.disable) body.InternalUser.enabled = false;
+        if (opts.group) {
+          body.InternalUser.identityGroups = await resolveGroupId(client, opts.group);
+        }
+
+        const result = await client.ersPut(`/internaluser/${existing.id}`, body);
+        if (result.dryRun) { printDryRun(result); return; }
+        if (globalOpts.audit !== false) audit.log({ command: "internal-user update", name });
+        console.log(`Internal user "${name}" updated.`);
+      } catch (err) { printError(err); }
+    });
+
+  cmd.command("delete <name>")
+    .description("Delete an internal user")
+    .action(async (name, opts, command) => {
+      try {
+        const globalOpts = command.optsWithGlobals();
+        const conn = resolveConnection(globalOpts);
+        await checkWriteAllowed(conn, globalOpts);
+        const client = new IseClient(conn, {
+          noCache: !globalOpts.cache, debug: globalOpts.debug, dryRun: globalOpts.dryRun,
+        });
+
+        const existing = await findUserByName(client, name);
+        const result = await client.ersDelete(`/internaluser/${existing.id}`);
+        if (result.dryRun) { printDryRun(result); return; }
+        if (globalOpts.audit !== false) audit.log({ command: "internal-user delete", name });
+        console.log(`Internal user "${name}" deleted.`);
+      } catch (err) { printError(err); }
+    });
+};