---
- name: Manage network access authorization rules on ISE
  hosts: ise_servers
  gather_facts: false
  tasks:
    # - name: Get all
    #   cisco.ise.network_access_authorization_rules_info:
    #     ise_hostname: "{{ ise_hostname }}"
    #     ise_username: "{{ ise_username }}"
    #     ise_password: "{{ ise_password }}"
    #     ise_verify: "{{ ise_verify }}"
    #   register: result

    # - name: Print all
    #   ansible.builtin.debug:
    #     var: result

    # - name: Get by id
    #   cisco.ise.network_access_authorization_rules_info:
    #     ise_hostname: "{{ ise_hostname }}"
    #     ise_username: "{{ ise_username }}"
    #     ise_password: "{{ ise_password }}"
    #     ise_verify: "{{ ise_verify }}"
    #     id: d704e911-a916-11eb-8830-2ec507028ea8
    #   register: result

    - name: Create a network_access_authorization_rules
      cisco.ise.network_access_authorization_rules:
        ise_hostname: "{{ ise_hostname }}"
        ise_username: "{{ ise_username }}"
        ise_password: "{{ ise_password }}"
        ise_verify: "{{ ise_verify }}"
        state: present
        rule:
          default: false
          name: Test2
          hitCounts: 0
          rank: 0
          state: disabled
          condition:
            conditionType: ConditionReference
            isNegate: false
            dictionaryName: Network Access
            attributeName: EapAuthentication
            operator: equals
            attributeValue: EAP-MSCHAPv2
            name: EAP-MSCHAPv2
            id: c456a490-0429-4fd4-91d7-efd1eb1f855a
        profile:
          - PermitAccess
        securityGroup: BYOD
        policyId: acd4b55d-dca3-4b93-a160-8a2d01669827
      register: result

    - name: Print create result
      ansible.builtin.debug:
        var: result

    - name: Update a network_access_authorization_rule
      cisco.ise.network_access_authorization_rules:
        ise_hostname: "{{ ise_hostname }}"
        ise_username: "{{ ise_username }}"
        ise_password: "{{ ise_password }}"
        ise_verify: "{{ ise_verify }}"
        state: present
        rule:
          default: false
          name: Test2
          hitCounts: 0
          rank: 0
          state: disabled
          condition:
            conditionType: ConditionReference
            isNegate: false
            dictionaryName: Network Access
            attributeName: EapAuthentication
            operator: equals
            attributeValue: EAP-MSCHAPv2
            name: EAP-MSCHAPv2
            id: c456a490-0429-4fd4-91d7-efd1eb1f855a
        profile:
          - PermitAccess
        securityGroup: Employee
        policyId: acd4b55d-dca3-4b93-a160-8a2d01669827
        id: 9a2ff8d6-e086-5af5-ab4b-78e10c7adf61
      register: result

    - name: Print update result
      ansible.builtin.debug:
        var: result
