$schema: http://support.riverbed.com/apis/service_def/2.2
defaultAuthorization: none
description: REST API for the AAA service
id: http://support.riverbed.com/apis/mgmt.aaa/2.5
name: mgmt.aaa
provider: riverbed
resources:
  access_tokens:
    additionalProperties: false
    description: Access token handling
    links:
      request:
        description: Request a new access token
        method: POST
        request:
          additionalProperties: false
          description: Access token request details
          oneOf:
          - additionalProperties: true
            required:
            - user_credentials
            type: object
          - additionalProperties: true
            properties:
              generate_refresh_token:
                enum:
                - false
                type: boolean
            required:
            - refresh_token
            tags:
              relint-disable:
              - C0200
            type: object
          properties:
            generate_refresh_token:
              description: 'If True, a refresh token will also be returned

                '
              type: boolean
            refresh_token:
              $ref: '#/types/refresh_token_assertion'
            state:
              description: 'Optional opaque value to pass back with the token

                '
              type: string
            user_credentials:
              $ref: '#/types/user_credentials_assertion'
          type: object
        response:
          additionalProperties: false
          description: Granted access token details
          properties:
            access_token:
              description: The new access token
              type: string
            expires_at:
              description: 'The Unix epoch time when the access token will expire

                '
              type: integer
            refresh_token:
              description: 'The new refresh token, if requested.  This token must
                be stored securely.

                '
              type: string
            state:
              description: 'The value of the state field in the request, if present

                '
              type: string
            token_type:
              description: The type of token issued
              enum:
              - bearer
              type: string
          required:
          - access_token
          - expires_at
          - token_type
          type: object
      self:
        path: $/token
    tags:
      relint-disable:
      - C0002
      - C0200
    type: object
  account_lockout:
    additionalProperties: false
    description: Account lockout settings
    links:
      get:
        method: GET
        response:
          $ref: '#/resources/account_lockout'
      self:
        path: $/account_lockout
      set:
        method: PUT
        request:
          $ref: '#/resources/account_lockout'
        response:
          $ref: '#/resources/account_lockout'
    properties:
      attempt_window:
        description: 'Time window, in minutes, in which failed login attempts are
          counted toward lockout.

          '
        type: integer
      attempts:
        description: 'Number of consecutive failed login attempts within the attempt
          window that will trigger a lockout

          '
        type: integer
      enable:
        description: Whether account lockout is enabled or not.
        type: boolean
      max_attempt_window:
        description: 'Maximum configurable attempt window in minutes

          '
        readOnly: true
        type: integer
      max_attempts:
        description: 'Maximum configurable attempts for lockout

          '
        readOnly: true
        type: integer
      min_attempt_window:
        description: 'Minimum configurable attempt window in minutes

          '
        readOnly: true
        type: integer
      min_attempts:
        description: 'Minimum configurable attempts for lockout

          '
        readOnly: true
        type: integer
    required:
    - enable
    - attempt_window
    - attempts
    type: object
  account_policy:
    additionalProperties: false
    description: Global account settings
    links:
      get:
        method: GET
        response:
          $ref: '#/resources/account_policy'
      self:
        path: $/account_policy
      set:
        method: PUT
        request:
          $ref: '#/resources/account_policy'
        response:
          $ref: '#/resources/account_policy'
    properties:
      login_policy:
        additionalProperties: false
        description: Settings related to login attempts
        properties:
          count:
            description: 'Maximum failed login attempts before temporary account lock.  0
              disables this check.

              '
            minimum: 0
            type: integer
          wait_time:
            description: 'Length in minutes for temporary account lock. N/A when count
              is 0.

              '
            minimum: 0
            type: integer
        required:
        - count
        - wait_time
        type: object
      password_policy:
        additionalProperties: false
        description: 'Password complexity and expiration settings

          '
        properties:
          change_frequency:
            description: 'Minimum number of days a user must wait between password
              changes. 0 disables this check.

              '
            minimum: 0
            type: integer
          dictionary_check:
            description: Disallow passwords based on common words
            type: boolean
          difference:
            description: 'Minimum number of character differences required between
              two passwords. 0 disables this check.

              '
            minimum: 0
            type: integer
          digits:
            description: 'Minimum number of digits.  0 Disables this check.

              '
            minimum: 0
            type: integer
          expiration:
            additionalProperties: false
            description: Password expiration settings
            properties:
              inactive:
                additionalProperties: false
                description: Account inactivity settings
                properties:
                  enabled:
                    description: 'Whether to mark accounts inactive if their password
                      remains expired for a period of time

                      '
                    type: boolean
                  value:
                    description: 'Number of days before an account with an expired
                      password is marked inactive

                      '
                    minimum: 0
                    type: integer
                type: object
              time:
                additionalProperties: false
                description: Password expiration settings
                properties:
                  enabled:
                    description: 'Whether to expire passwords after a period of time

                      '
                    type: boolean
                  value:
                    description: 'Number of days before a password expires

                      '
                    minimum: 0
                    type: integer
                type: object
              warn:
                description: 'Number of days before password expiration to start warning
                  a user

                  '
                minimum: 0
                type: integer
            required:
            - time
            - inactive
            - warn
            type: object
          lower_case:
            description: 'Minimum number of lowercase characters. 0 disables this
              check.

              '
            minimum: 0
            type: integer
          minimum_length:
            description: Minimum password length.
            maximum: 64
            minimum: 1
            type: integer
          permit_empty_passwords:
            description: Allow users to have empty passwords.
            type: boolean
          repeat:
            description: 'Maximum times the same character can repeat consecutively.
              0 disables this check.

              '
            minimum: 0
            type: integer
          reuse_interval:
            description: 'Number of previous passwords to save.  When setting a new
              password, the user cannot use a password that exists in their password
              history. 0 disables this check.

              '
            maximum: 10
            minimum: 0
            type: integer
          symbols:
            description: 'Minimum number of symbols. 0 disables this check.

              '
            minimum: 0
            type: integer
          upper_case:
            description: 'Minimum number of uppercase characters. 0 disables this
              check.

              '
            minimum: 0
            type: integer
        required:
        - permit_empty_passwords
        - minimum_length
        - lower_case
        - upper_case
        - digits
        - symbols
        - repeat
        - difference
        - dictionary_check
        - change_frequency
        - reuse_interval
        - expiration
        type: object
    required:
    - login_policy
    - password_policy
    type: object
  console_inactivity:
    additionalProperties: false
    description: Console inactivity timeout settings
    links:
      get:
        method: GET
        response:
          $ref: '#/resources/console_inactivity'
      self:
        path: $/console_inactivity
      set:
        method: PUT
        request:
          $ref: '#/resources/console_inactivity'
        response:
          $ref: '#/resources/console_inactivity'
    properties:
      enable:
        description: Whether inactivity timeout is enabled or not.
        type: boolean
      max_timeout:
        description: 'Maximum configurable inactivity timeout in minutes

          '
        readOnly: true
        type: integer
      min_timeout:
        description: 'Minimum configurable inactivity timeout in minutes

          '
        readOnly: true
        type: integer
      timeout:
        description: 'Time, in minutes, a user can be inactive during console session
          before disconnecting.

          '
        type: integer
    required:
    - enable
    - timeout
    type: object
  known_user:
    additionalProperties: false
    description: 'A remotely authenticated user known to the system

      '
    links:
      delete:
        method: DELETE
      get:
        method: GET
        response:
          $ref: '#/resources/known_user'
      self:
        path: $/known_users/items/{name}
    properties:
      cached_roles:
        description: The roles last granted to this user
        items:
          description: The id of a cached role
          relations:
            full:
              description: The full definition of the role
              resource: '#/resources/role'
              vars:
                id: '0'
          type: integer
        type: array
      last_auth_method:
        description: 'Last authentication method used for user.

          '
        type: string
      last_auth_time:
        description: 'Unix epoch time the user was last authenticated.

          '
        type: integer
      name:
        description: Name of the user
        type: string
    required:
    - name
    - last_auth_time
    - last_auth_method
    - cached_roles
    type: object
  known_users:
    additionalProperties: false
    description: All remotely authenticated users known to the system
    links:
      get:
        method: GET
        response:
          $ref: '#/resources/known_users'
      self:
        path: $/known_users
      set:
        method: PUT
        request:
          $ref: '#/resources/known_users'
        response:
          $ref: '#/resources/known_users'
    properties:
      enable:
        description: 'Whether the known_user cache is enabled or not. When disabled,
          all users will be removed from the cache and no new users will be added.

          '
        type: boolean
      items:
        description: All known_user instances
        items:
          $ref: '#/resources/known_user'
        readOnly: true
        type: array
    required:
    - enable
    type: object
  locked_user:
    additionalProperties: false
    description: 'A user that is locked after consecutive login failures

      '
    links:
      delete:
        method: DELETE
      get:
        method: GET
        response:
          $ref: '#/resources/locked_user'
      self:
        path: $/locked_users/items/{name}
    properties:
      last_failed_attempt:
        description: 'Unix epoch time the user triggered the lockout

          '
        type: integer
      name:
        description: Name of the user
        type: string
    required:
    - name
    - last_failed_attempt
    type: object
  locked_users:
    additionalProperties: false
    description: All locked users known to the system
    links:
      get:
        method: GET
        response:
          $ref: '#/resources/locked_users'
      self:
        path: $/locked_users
    properties:
      items:
        description: All locked users
        items:
          $ref: '#/resources/locked_user'
        readOnly: true
        type: array
    required:
    - items
    type: object
  lockout_exempt_user:
    additionalProperties: false
    description: 'A user that is exempt from lockout

      '
    links:
      delete:
        method: DELETE
      get:
        method: GET
        response:
          $ref: '#/resources/lockout_exempt_user'
      self:
        path: $/lockout_exempt_users/items/{name}
    properties:
      name:
        description: Name of the user
        type: string
    required:
    - name
    type: object
  lockout_exempt_users:
    additionalProperties: false
    description: All lockout exempt users known to the system
    links:
      create:
        method: POST
        request:
          $ref: '#/resources/lockout_exempt_user'
        response:
          $ref: '#/resources/lockout_exempt_user'
      get:
        method: GET
        response:
          $ref: '#/resources/lockout_exempt_users'
      self:
        path: $/lockout_exempt_users
    properties:
      items:
        description: All lockout exempt users
        items:
          $ref: '#/resources/lockout_exempt_user'
        readOnly: true
        type: array
    required:
    - items
    type: object
  passwords:
    additionalProperties: false
    description: 'Local user password management

      '
    links:
      change_password:
        description: 'Change a local user''s password.  Old password is required when
          changing your own password.

          '
        method: POST
        path: $/users/change_password
        request:
          additionalProperties: false
          properties:
            new_password:
              description: New password, in plaintext
              type: string
            old_password:
              description: Old password, in plaintext
              type: string
            user:
              description: User account to change password
              type: string
          required:
          - user
          - new_password
          type: object
        response:
          additionalProperties: false
          properties:
            changed:
              description: 'Whether the password was successfully changed

                '
              type: boolean
            user:
              description: User account
              type: string
          required:
          - user
          - changed
          type: object
      self:
        path: $/passwords
    type: object
  permission_group:
    additionalProperties: false
    description: Service resource group used to assign permissions
    links:
      get:
        method: GET
        response:
          $ref: '#/resources/permission_group'
      self:
        path: $/permission_groups/{name}
    properties:
      description:
        description: Brief description of group
        type: string
      name:
        description: Unique ID for group
        pattern: '[a-zA-Z0-9_]+$'
        readOnly: true
        type: string
      pretty_name:
        description: Display name for group
        type: string
      resources:
        description: List of resources that exist in this group
        items:
          $ref: '#/types/service_resource'
        type: array
    relations:
      instances:
        resource: '#/resources/permission_groups'
    required:
    - name
    - pretty_name
    - description
    - resources
    type: object
  permission_groups:
    additionalProperties: false
    description: Collection of service resource groups
    links:
      get:
        method: GET
        response:
          $ref: '#/resources/permission_groups'
      self:
        path: $/permission_groups
    properties:
      items:
        description: List of service resource groups
        items:
          $ref: '#/resources/permission_group'
        type: array
    required:
    - items
    type: object
  radius_server:
    additionalProperties: false
    description: A RADIUS authentication server
    links:
      delete:
        method: DELETE
      get:
        method: GET
        response:
          $ref: '#/resources/radius_server'
      self:
        path: $/radius_servers/items/{id}
      set:
        method: PUT
        request:
          $ref: '#/resources/radius_server'
        response:
          $ref: '#/resources/radius_server'
    properties:
      enabled:
        description: 'Whether this RADIUS server is enabled or not.  A server is enabled
          when it is in the server_order list in the radius_servers resource.

          '
        readOnly: true
        type: boolean
      host:
        description: The hostname or IP address of the RADIUS server
        minLength: 1
        type: string
      id:
        description: Server ID
        readOnly: true
        type: integer
      new_key:
        description: 'The secret key used to encrypt communications.  An empty string
          indicates no encryption is used.

          '
        maxLength: 64
        type: string
      port:
        default: 1812
        description: The port of the RADIUS server
        maximum: 65535
        minimum: 1
        type: integer
      timeout:
        description: 'Max time, in seconds, to wait for the server to respond to an
          auth request.

          '
        maximum: 30
        minimum: 1
        type: integer
    required:
    - host
    - port
    - timeout
    type: object
  radius_servers:
    additionalProperties: false
    description: The configured RADIUS servers
    links:
      create:
        method: POST
        request:
          $ref: '#/resources/radius_server'
        response:
          $ref: '#/resources/radius_server'
      get:
        method: GET
        response:
          $ref: '#/resources/radius_servers'
      self:
        path: $/radius_servers
      set:
        method: PUT
        request:
          $ref: '#/resources/radius_servers'
        response:
          $ref: '#/resources/radius_servers'
    properties:
      available_encryption:
        description: Available encryption protocols
        items:
          type: string
        readOnly: true
        type: array
      encryption_protocol:
        description: 'The encryption protocol to use.  Available protocols are listed
          under available_encryption.

          '
        type: string
      require_message_authenticator:
        description: 'If True, discard server packets which do not contain Message-Authenticator

          '
        type: boolean
      server_priority:
        description: 'The order in which authentication requests are made to the configured
          servers.  Servers not in this list will be disabled.

          '
        items:
          relations:
            full:
              resource: '#/resources/radius_server'
              vars:
                id: '0'
          type: integer
        type: array
      servers:
        description: The configured RADIUS servers
        items:
          $ref: '#/resources/radius_server'
        readOnly: true
        type: array
    required:
    - server_priority
    - encryption_protocol
    - require_message_authenticator
    type: object
  refresh_tokens:
    additionalProperties: false
    description: 'Active refresh tokens.  Only the first few characters of the token
      are revealed, enough for the caller to differentiate the tokens they own.

      '
    links:
      get:
        method: GET
        response:
          $ref: '#/resources/refresh_tokens'
      revoke:
        description: Revoke a refresh token
        method: POST
        path: $/refresh_tokens/revoke
        request:
          additionalProperties: false
          properties:
            refresh_token:
              description: The refresh token to revoke
              type: string
          required:
          - refresh_token
          type: object
      self:
        path: $/refresh_tokens
    properties:
      items:
        items:
          additionalProperties: false
          description: A single refresh token
          properties:
            issued_at:
              description: 'The Unix epoch time that the refresh token was issued

                '
            last_redeemed:
              description: 'The Unix epoch time that the token was last redeemed.  0
                if it has never been used.

                '
              minimum: 0
              type: integer
            partial_token:
              description: 'The first few characters of the token

                '
              type: string
            times_redeemed:
              description: 'The number of times the token has been redeemed

                '
              minimum: 0
              type: integer
            user:
              description: 'The user name which owns this token

                '
              type: string
          required:
          - user
          - partial_token
          - issued_at
          - last_redeemed
          - times_redeemed
          type: object
        type: array
    required:
    - items
    tags:
      relint-disable:
      - C0200
    type: object
  remote_authentication:
    additionalProperties: false
    description: Remote authentication settings
    links:
      get:
        method: GET
        response:
          $ref: '#/resources/remote_authentication'
      self:
        path: $/remote_authentication
      set:
        method: PUT
        request:
          $ref: '#/resources/remote_authentication'
        response:
          $ref: '#/resources/remote_authentication'
    properties:
      auth_methods_available:
        description: Available authentication methods
        items:
          type: string
        readOnly: true
        type: array
      auth_sequence:
        description: 'Authentication methods to use, in priority order of first to
          last.  Possible values are listed in auth_methods_available.

          '
        items:
          type: string
        type: array
      default_roles:
        description: 'The roles to assign to a remotely-authenticated user when the
          authentication server does not specify any.

          '
        items:
          relations:
            full:
              resource: '#/resources/role'
              vars:
                id: '0'
          type: integer
        type: array
      next_method_on_reject:
        description: 'If True, when a login is rejected, the system will still attempt
          to authenticate via the next method in auth_sequence.  If False, the login
          attempt is denied immediately when any auth method rejects the user credentials.

          '
        type: boolean
    required:
    - auth_sequence
    - next_method_on_reject
    - default_roles
    type: object
  role:
    additionalProperties: false
    description: 'A set of permissions that may be assigned to a user

      '
    links:
      delete:
        method: DELETE
      get:
        method: GET
        response:
          $ref: '#/resources/role'
      self:
        path: $/roles/{id}
      set:
        method: PUT
        request:
          $ref: '#/resources/role'
        response:
          $ref: '#/resources/role'
    properties:
      description:
        description: Role description
        maxLength: 255
        type: string
      id:
        description: Unique role identifier
        readOnly: true
        type: integer
      member_of:
        description: Roles that this role is a member of
        items:
          description: A role identifier
          relations:
            full:
              resource: '#/resources/role'
              vars:
                name: '0'
          type: integer
        type: array
      permissions:
        description: A set of permissions granted to this role
        items:
          additionalProperties: false
          description: 'One permission group and the access rights granted to it

            '
          properties:
            operation:
              description: 'The access rights granted to the permission group

                '
              enum:
              - read_only
              - read_write
              type: string
            permission_group:
              description: The permission group
              relations:
                full:
                  resource: '#/resources/permission_group'
                  vars:
                    name: '0'
              type: string
          type: object
        type: array
      pretty_name:
        description: Unique role name
        maxLength: 50
        type: string
      system_default:
        description: 'If true, role is a system default entry that cannot be modified

          '
        readOnly: true
        type: boolean
    required:
    - pretty_name
    type: object
  role_names:
    additionalProperties: false
    description: The list of roles and their names
    links:
      get:
        method: GET
        response:
          $ref: '#/resources/role_names'
      self:
        path: $/role_names
    properties:
      items:
        items:
          additionalProperties: false
          description: Name and description for a single role
          properties:
            description:
              description: Role description
              type: string
            id:
              description: Unique role identifier
              type: integer
            pretty_name:
              description: Unique role name
              type: string
          relations:
            full:
              description: The full role definition
              resource: '#/resources/role'
              vars:
                id: 0/id
          required:
          - id
          - pretty_name
          - description
          type: object
        type: array
    required:
    - items
    type: object
  roles:
    additionalProperties: false
    description: All configured roles
    links:
      create:
        method: POST
        request:
          $ref: '#/resources/role'
        response:
          $ref: '#/resources/role'
      get:
        method: GET
        response:
          $ref: '#/resources/roles'
      self:
        path: $/roles
    properties:
      items:
        description: A role identifier
        items:
          $ref: '#/resources/role'
        type: array
    type: object
  tacacs_server:
    additionalProperties: false
    description: A TACACS+ authentication server
    links:
      delete:
        method: DELETE
      get:
        method: GET
        response:
          $ref: '#/resources/tacacs_server'
      self:
        path: $/tacacs_servers/items/{id}
      set:
        method: PUT
        request:
          $ref: '#/resources/tacacs_server'
        response:
          $ref: '#/resources/tacacs_server'
    properties:
      enabled:
        description: 'Whether this TACACS+ server is enabled or not.  A server is
          enabled when it is in the server_order list in the tacacs_servers resource.

          '
        readOnly: true
        type: boolean
      host:
        description: The hostname or IP address of the TACACS+ server
        minLength: 1
        type: string
      id:
        description: Server ID
        readOnly: true
        type: integer
      new_key:
        description: 'The secret key used to encrypt communications.  An empty string
          indicates no encryption is used.

          '
        maxLength: 64
        type: string
      port:
        default: 49
        description: The post of the TACACS+ server
        maximum: 65535
        minimum: 1
        type: integer
    required:
    - host
    - port
    type: object
  tacacs_servers:
    additionalProperties: false
    description: The configured TACACS+ servers
    links:
      create:
        method: POST
        request:
          $ref: '#/resources/tacacs_server'
        response:
          $ref: '#/resources/tacacs_server'
      get:
        method: GET
        response:
          $ref: '#/resources/tacacs_servers'
      self:
        path: $/tacacs_servers
      set:
        method: PUT
        request:
          $ref: '#/resources/tacacs_servers'
        response:
          $ref: '#/resources/tacacs_servers'
    properties:
      server_priority:
        description: 'The order in which authentication requests are made to the configured
          servers.  Servers not in this list will be disabled.

          '
        items:
          relations:
            full:
              resource: '#/resources/tacacs_server'
              vars:
                id: '0'
          type: integer
        type: array
      servers:
        description: The configured TACACS+ servers
        items:
          $ref: '#/resources/tacacs_server'
        readOnly: true
        type: array
      timeout:
        description: 'Max time, in seconds, to wait for a server to respond to an
          auth request.

          '
        maximum: 30
        minimum: 1
        type: integer
    required:
    - server_priority
    - timeout
    type: object
  user:
    additionalProperties: false
    description: A user configured for local authentication
    links:
      delete:
        method: DELETE
      get:
        method: GET
        response:
          $ref: '#/resources/user'
      self:
        path: $/users/{name}
      set:
        method: PUT
        request:
          $ref: '#/resources/user'
        response:
          $ref: '#/resources/user'
    properties:
      account_never_inactive:
        default: false
        description: 'User account will never become inactive, preventing login, due
          to an expired password

          '
        type: boolean
      description:
        default: ''
        description: Description for the user account
        maxLength: 255
        type: string
      enable:
        default: false
        description: Whether the user is allowed to log in
        type: boolean
      logged_in:
        description: User is currently logged in
        readOnly: true
        type: boolean
      login_failure:
        additionalProperties: false
        description: Login failure information
        properties:
          count:
            description: Number of failed login attempts
            type: integer
          date:
            description: 'Date, in Unix epoch time, of the most recent login failure

              '
            type: timestamp
          source:
            description: 'Address of the most recent login failure

              '
            type: string
        readOnly: true
        type: object
      name:
        description: Account name
        maxLength: 32
        type: string
      new_password:
        additionalProperties: false
        description: 'Set this user''s password to a new value.  Used for creation
          and bulk importing of users.  Normal password changes should go through
          the password resource.  Changing passwords using this API may result in
          passwords which violate the password policy.

          '
        oneOf:
        - required:
          - cleartext
          type: object
        - required:
          - hashed
          type: object
        properties:
          cleartext:
            description: 'Set the user''s password in plain text

              '
            type: string
          hashed:
            description: 'Set the user''s password as a hash

              '
            type: string
        type: object
      password:
        additionalProperties: false
        description: Password settings
        properties:
          change_allowed_in:
            description: 'Days remaining until the user can change their password.  A
              value of 0 indicates the password may be changed immediately.

              '
            readOnly: true
            type: integer
          expires_on:
            description: 'Date, in Unix epoch time, after which the user''s password
              will expire.  If 0, the password will never expire.

              '
            readOnly: true
            type: timestamp
          locks_on:
            description: 'Date, in Unix epoch time, after which the user account will
              be locked due to an expired password. If 0, the account will never be
              locked.

              '
            readOnly: true
            type: timestamp
        required:
        - expires_on
        - locks_on
        - change_allowed_in
        type: object
      password_never_expires:
        default: false
        description: User account password will never expire
        type: boolean
      roles:
        description: List of roles granted to this user
        items:
          description: The role identifier
          relations:
            full:
              resource: '#/resources/role'
              vars:
                id: '0'
          type: integer
        type: array
      status:
        description: Status of the account
        enum:
        - active
        - inactive
        - disabled
        - login_failure_lockout
        readOnly: true
        type: string
    required:
    - name
    type: object
  users:
    additionalProperties: false
    description: The users configured for local authentication
    links:
      create:
        method: POST
        request:
          $ref: '#/resources/user'
        response:
          $ref: '#/resources/user'
      get:
        method: GET
        response:
          $ref: '#/resources/users'
      self:
        path: $/users
    properties:
      items:
        items:
          $ref: '#/resources/user'
        type: array
    type: object
title: AAA Service
types:
  refresh_token_assertion:
    description: A refresh token assertion
    type: string
  service_resource:
    additionalProperties: false
    description: 'Resources available from a service.  If only the service_name property
      is present, all resources are included.

      '
    not:
      required:
      - all_except
      - only_include
      type: object
    properties:
      all_except:
        description: 'List of resources excluded from this group. All other resources
          from this service are included.

          '
        items:
          type: string
        type: array
      only_include:
        description: 'List of resources included in this group.  All other resources
          from this service are excluded.

          '
        items:
          type: string
        type: array
      service_name:
        description: Name of the service
        readOnly: true
        type: string
    required:
    - service_name
    type: object
  user_credentials_assertion:
    additionalProperties: false
    description: A username/password assertion
    properties:
      password:
        description: Password
        type: string
      username:
        description: Username
        type: string
    required:
    - username
    - password
    type: object
version: '2.5'
