Least permissions
Prerequisites and least-privilege service account permissions for each OneFuse module endpoint type
Module endpoints
Create and manage reusable OneFuse module endpoints, including form fields and proxy support
10 minute read
Module Endpoints are reusable across OneFuse Policies of the same Endpoint Type.
A Module Endpoint is a prerequisite to creating OneFuse Policies for Modules.
The following modules utilize Module Endpoints:
- Ansible Tower
- DNS
- IPAM
- Microsoft Active Directory
- Naming (when using Validators)
- ServiceNow CMDB
- ServiceNow Connector
- VMware Aria Automation
Access module endpoints
- Log in to the OneFuse UI.
- In the Workspace, select Module Endpoints from the left navigation menu.
This area displays all active Module Endpoints by Endpoint Type.
Perform the following from the Actions column:
| Action | Workspace role(s) |
|---|---|
| View | Admins, Members, or Viewers |
| Edit | Admins or Members |
| Delete | Admins or Members |
Manage module endpoints
A Module Credential is a prerequisite to creating OneFuse Module Endpoints.
Module Endpoint form
View a list of vendor supported versions.
Ansible Tower
An Ansible Tower Module Endpoint is a pointer to an existing Ansible Tower web console. Used for OneFuse Ansible Tower Policies.
| Field | Description |
|---|---|
| Ansible Tower Endpoint Name | Enter a name for this Endpoint. |
| Description | Optional description for this Endpoint. |
| Uses SSL | Toggle to indicate whether or not this Endpoint uses SSL. Defaults to true. |
| Ansible Tower Host | Enter the Ansible Tower Host in FQDN or IPv4 format. |
| Port | Enter the Port number for this Endpoint. |
| Module Credential | Select from the dropdown for an existing Module Credential with Endpoint Type: Ansible Tower. |
BlueCat
A BlueCat Endpoint is a pointer to an existing BlueCat IPAM and/or DNS instance. Used for OneFuse IPAM Policies and/or DNS Policies.
| Field | Description |
|---|---|
| General | |
| BlueCat Endpoint Name | Enter a name for this Endpoint. |
| Description | Optional description for this Endpoint. |
| Uses SSL | Toggle to indicate whether or not this Endpoint uses SSL. Defaults to true. |
| BlueCat Host | Enter the BlueCat DDI Host in FQDN or IPv4 format. |
| Port | Enter the Port number for this Endpoint. |
| Module Credential | Select from the dropdown for an existing Module Credential with Endpoint Type: BlueCat. |
| Advanced | |
| Single Threaded Operations | Select whether or not to restrict all API operations utilizing this Endpoint to one simultaneous operation. Defaults to true. |
| Shared - Defaults | |
| Deployment Type | Select the Deployment Method for this BlueCat Endpoint. Currently, Selective Deploy is supported. |
| BlueCat Configuration Name | Enter the default BlueCat Configuration Name for IPAM and/or DNS managed by this BlueCat Endpoint. Templatable field. |
| IPAM - Defaults | |
| IP Address Record User-Defined Field(s) | Optional. Enter IP Address Record User-Defined Field(s) as JSON with key:value pairs to get set on the IP Address Record User-Defined Field of the IP Address Record. Templatable field. |
| DNS - Defaults | |
| DNS View | Enter the default BlueCat DNS View name managed by this BlueCat DDI instance. Templatable field. |
| Host Record User-Defined Field(s) | Optional. Enter Host Record User-Defined Field(s) as JSON with key:value pairs to get set on the Host Record User-Defined Field of the DNS Record. Templatable field. |
DNS
A DNS Endpoint is a pointer to an existing DNS server. Used for OneFuse Validators.
| Field | Description |
|---|---|
| DNS Endpoint Name | Enter a name for this DNS Endpoint. |
| Description | Optional description for this DNS Endpoint. |
| DNS Host | DNS server’s FQDN or IP Address. |
Infoblox
An Infoblox Endpoint is a pointer to an existing Infoblox IPAM and/or DNS instance. Used for OneFuse IPAM Policies and/or DNS Policies.
| Field | Description |
|---|---|
| General | |
| Infoblox Endpoint Name | Enter a name for this Endpoint. |
| Description | Optional description for this Endpoint. |
| Uses SSL | Toggle to indicate whether or not this Endpoint uses SSL. Defaults to true. |
| Infoblox Host | Enter the Infoblox Host in FQDN or IPv4 format. |
| Port | Enter the Port number for this Endpoint. |
| Module Credential | Select from the dropdown for an existing Module Credential with Endpoint Type: Infoblox. |
| Advanced | |
| Single Threaded Operations | Select whether or not to restrict all API operations utilizing this Endpoint to one simultaneous operation. Defaults to true. |
| IPAM - Defaults | |
| Network View | Enter the name of the Infoblox Network View managed by this Endpoint. Defaults to default. Templatable field. |
| Fixed Address Record Template | Enables additional configuration by adding fields into the JSON payload for the Fixed Address Record. Templatable field. |
| DNS - Defaults | |
| DNS View | Enter the name of the DNS View managed by this Endpoint. Defaults to default. Templatable field. |
| Host Record Template | Enables additional configuration by adding fields into the JSON payload for the Host Record. Templatable field. |
| A Record Template | Enables additional configuration by adding fields into the JSON payload for the A Record. Templatable field. |
| PTR Record Template | Enables additional configuration by adding fields into the JSON payload for the PTR Record. Templatable field. |
Men&Mice Micetro
A Men&Mice Micetro Endpoint is a pointer to an existing Men&Mice Micetro IPAM and/or DNS instance. Used for OneFuse IPAM Policies and/or DNS Policies.
| Field | Description |
|---|---|
| General | |
| Men&Mice Micetro Endpoint Name | Enter a name for this Endpoint. |
| Description | Optional description for this Endpoint. |
| Uses SSL | Toggle to indicate whether or not this Endpoint uses SSL. Defaults to true. |
| Men&Mice Micetro Host | Enter the Men&Mice Micetro Host in FQDN or IPv4 format. |
| Port | Enter the Port number for this Endpoint. |
| Module Credential | Select from the dropdown for an existing Module Credential with Endpoint Type: Men&Mice Micetro. |
| Advanced | |
| Single Threaded Operations | Select whether or not to restrict all API operations utilizing this Endpoint to one simultaneous operation. Defaults to true. |
| IPAM - Defaults | |
| Device Custom Properties | Optional. Enter Device Custom Properties as JSON with key:value pairs to get set on the Device Custom Properties field of the IP Address/DNS Record. Templatable field. |
Microsoft
A Microsoft Endpoint is a pointer to an existing Microsoft Active Directory, IPAM, and/or DNS instance. Used for OneFuse IPAM Policies, DNS Policies, and/or Microsoft Active Directory Policies.
| Field | Description |
|---|---|
| General | |
| Microsoft Endpoint Name | Enter a name for this Endpoint. |
| Description | Optional description for this Endpoint. |
| Connection Method | Select the desired connection method for this Endpoint. Currently, only OpenSSH is supported. |
| Use Jump Host | Toggle to determine whether this Endpoint should use a Jump Host connection to a target host. |
| Microsoft Host | Enter the Microsoft Host in FQDN or IPv4 format. |
| Port | Enter the Port number for this Endpoint. |
| Module Credential | Select from the dropdown for an existing Module Credential with Endpoint Type: Microsoft. |
| Advanced | |
| Single Threaded Operations | Select whether or not to restrict all API operations utilizing this Endpoint to one simultaneous operation. Defaults to true. |
| Defaults | |
| Temporary Directory for Scripts | Define the Temporary Directory to place scripts on the Microsoft Endpoint. The Module Credential must have permission to write and remove files from this directory. Templatable field. |
| Share Path for Temporary Directory | Optional. Define the Share Path (path\share) for the Scripts Temporary Directory. Share Path is accessed when Administrative Shares are not available. Templatable field. |
ServiceNow
A ServiceNow Endpoint is a pointer to an existing ServiceNow instance. Used for OneFuse ServiceNow CMDB Policies and ServiceNow Catalog Item Policies.
| Field | Description |
|---|---|
| ServiceNow Endpoint Name | Enter a name for this Endpoint. |
| Description | Optional description for this Endpoint. |
| Instance | Enter a valid ServiceNow instance. |
| Module Credential | Select from the dropdown for an existing Module Credential with Endpoint Type: ServiceNow. |
SolarWinds
A SolarWinds Endpoint is a pointer to an existing SolarWinds Orion instance for IPAM and/or DNS. Used for OneFuse IPAM Policies and/or DNS Policies.
| Field | Description |
|---|---|
| General | |
| SolarWinds Endpoint Name | Enter a name for this Endpoint. |
| Description | Optional description for this Endpoint. |
| Uses SSL | Toggle to indicate whether or not this Endpoint uses SSL. Defaults to true. |
| SolarWinds Host | Enter the SolarWinds Host in FQDN or IPv4 format. |
| Port | Enter the Port number for this Endpoint. |
| Module Credential | Select from the dropdown for an existing Module Credential with Endpoint Type: SolarWinds. |
| Advanced | |
| Single Threaded Operations | Select whether or not to restrict all API operations utilizing this Endpoint to one simultaneous operation. Defaults to false. |
| IPAM - Defaults | |
| IPAM Comment | Optional. Enter a comment to appear on the reserved IP Address (for example, “Created by OneFuse”). Templatable field. |
VMware vRealize Automation 7
A VMware vRealize Automation 7 Endpoint is a pointer to an existing VMware vRealize Automation 7 IaaS instance. Used for OneFuse Validators.
OneFuse currently only supports VMware vRealize Automation 7.6.
| Field | Description |
|---|---|
| VMware vRealize Automation 7 Endpoint Name | Enter a name for this Endpoint. |
| Description | Optional description for this Endpoint. |
| Uses SSL | Toggle to indicate whether or not this Endpoint uses SSL. Defaults to true. |
| vRealize Automation 7 IaaS Host | Enter the VMware vRealize Automation 7 IaaS Host in FQDN or IPv4 format. |
| Port | Enter the Port number for this Endpoint. |
| Module Credential | Select from the dropdown for an existing Module Credential with Endpoint Type: vRealize Automation 7. |
| Advanced | |
| Single Threaded Operations | Select whether or not to restrict all API operations utilizing this Endpoint to one simultaneous operation. Defaults to true. |
VMware Aria Automation
A VMware Aria Automation 8 Endpoint is a pointer to an existing Aria Automation instance by its Organization. Used for OneFuse Validators and Aria Automation Policies (versions 8.3+).
| Field | Description |
|---|---|
| VMware Aria Automation 8 Endpoint Name | Enter a name for this Endpoint. |
| Description | Optional description for this Endpoint. |
| Uses SSL | Toggle to indicate whether or not this Endpoint uses SSL. Defaults to true. |
| Aria Automation 8 Host | Enter the VMware Aria Automation 8 Host in FQDN or IPv4 format. |
| Port | Enter the Port number for this Endpoint. |
| Organization Name | Enter the Organization name. |
| Module Credential | Select from the dropdown for an existing Module Credential with Endpoint Type: Aria Automation 8. |
| Advanced | |
| Single Threaded Operations | Select whether or not to restrict all API operations utilizing this Endpoint to one simultaneous operation. Defaults to true. |
VMware Aria Automation Cloud
A VMware Aria Automation Cloud Endpoint is a pointer to an existing Aria Automation Cloud instance. Used for OneFuse Validators and Aria Automation Policies.
| Field | Description |
|---|---|
| VMware Aria Automation 8 Endpoint Name | Enter a name for this Endpoint. |
| Description | Optional description for this Endpoint. |
| Aria Automation Cloud Authentication | Enter the VMware Aria Automation Cloud Authentication URL. Defaults to console.cloud.vmware.com. |
| Aria Automation Cloud Application API | Enter the VMware Aria Automation Cloud Application API URL. Defaults to api.mgmt.cloud.vmware.com. |
| Module Credential | Select from the dropdown for an existing Module Credential with Endpoint Type: Aria Automation Cloud. |
| Advanced | |
| Single Threaded Operations | Select whether or not to restrict all API operations utilizing this Endpoint to one simultaneous operation. Defaults to true. |
Create an endpoint
- Access Module Endpoints.
- From the Module Endpoints datatable, select + Create.
- Select the Endpoint Type from the scrolling dropdown menu.
- Enter the field values on the Module Endpoint form and select Create.
- Use this Module Endpoint for OneFuse Policies.
Update an endpoint
Update a Module Endpoint to change the Endpoint Name, Description, Module Credential, and more.
- Access Module Endpoints.
- Find the Module Endpoint to update and select the edit button.
- Edit the information on the Module Endpoint form.
- Select Update.
Delete an endpoint
Module Endpoints cannot be deleted if they are tied to a OneFuse Policy for Module(s).
- Access Module Endpoints.
- Find the Module Endpoint and select the delete button.
- Select Delete to confirm.
Least permissions
See Least permissions for prerequisites and service account requirements per endpoint type.
Proxy support
Enable OneFuse Endpoint communication methods to be proxy enabled for the following: ServiceNow and VMware Aria Automation.
Prerequisites
If the proxy is an SSL intercepting proxy and the SSL key is a self-signed certificate, have the certificate ready.
Configure proxy
-
Log in to the target OneFuse web server using an SSH client.
-
Enter
shell_plus:# Navigate to /opt/cloudbolt/ directory cd /opt/cloudbolt/ # Start shell_plus ./manage.py shell_plus -
Copy the following snippet, replace the values, then paste it into
shell_plus:# Create a Connection Info for the proxy server # Replace the values for name, ip, port, protocol, username, and password c = ConnectionInfo(name="proxy", ip="proxy.example.com", port=3130, protocol="http", username="cloudbolt", password="cloudbolt") c.save() # Set the Connection Info on Global Preferences web_proxy setting gp = GlobalPreferences.get() gp.web_proxy = c # Set your bypass proxy domains # A comma-separated list of domains for which CloudBolt should not use the proxy. # Domain names are regular expressions and may be IPv4 addresses. # For example: '.*\.internal\.loc,192\.168\..*,my\.domain\.com' gp.bypass_proxy_domains = '10\..*,.*\.example\..*,.*\.company\.com' gp.save() # If the proxy is an SSL intercepting proxy with a self-signed certificate, # import the certificate into the certificate root store. # Replace <yourcert> with the certificate content. Remove this block if not applicable. c = RootCertificate(certificate="""<yourcert>""") c.save()
The following endpoints will now communicate through the proxy:
- ServiceNow Endpoint for the ServiceNow CMDB and/or ServiceNow Connector modules
- VMware Aria Automation Endpoint for the VMware Aria Automation module