module: ietf-system-tacacs-plus
  augment /sys:system:
    +--rw tacacs-plus
       +--rw server* [name]
          +--rw name                      string
          +--rw server-type               tacacs-plus-server-type
          +--rw address                   inet:host
          +--rw port?                     inet:port-number
          +--rw (security)
          |  +--:(obfuscation)
          |     +--rw shared-secret?      string
          +--rw (source-type)?
          |  +--:(source-ip)
          |  |  +--rw source-ip?          inet:ip-address
          |  +--:(source-interface)
          |     +--rw source-interface?   if:interface-ref
          +--rw vrf-instance?
          |       -> /ni:network-instances/network-instance/name
          +--rw single-connection?        boolean
          +--rw timeout?                  uint16
          +--ro statistics
             +--ro connection-opens?      yang:counter64
             +--ro connection-closes?     yang:counter64
             +--ro connection-aborts?     yang:counter64
             +--ro connection-failures?   yang:counter64
             +--ro connection-timeouts?   yang:counter64
             +--ro messages-sent?         yang:counter64
             +--ro messages-received?     yang:counter64
             +--ro errors-received?       yang:counter64
             +--ro sessions?              yang:counter64

module ietf-system-tacacs-plus {
  yang-version 1.1;
  namespace "urn:ietf:params:xml:ns:yang:ietf-system-tacacs-plus";
  prefix sys-tcs-plus;

  import ietf-inet-types {
    prefix inet;
    reference
      "RFC 6991: Common YANG Data Types";
  }
  import ietf-yang-types {
    prefix yang;
    reference
      "RFC 6991: Common YANG Data Types";
  }
  import ietf-network-instance {
    prefix ni;
    reference
      "RFC 8529: YANG Data Model for Network Instances";
  }
  import ietf-interfaces {
    prefix if;
    reference
      "RFC 8343: A YANG Data Model for Interface Management";
  }
  import ietf-system {
    prefix sys;
    reference
      "RFC 7317: A YANG Data Model for System Management";
  }
  import ietf-netconf-acm {
    prefix nacm;
    reference
      "RFC 8341: Network Configuration Access Control Model";
  }

  organization
    "IETF OPSAWG (Operations and Management Area Working Group)";
  contact
    "WG Web:   <http://datatracker.ietf.org/wg/opsawg/>
     WG List:  <mailto:opsawg@ietf.org>

     Editor: Bo Wu <lana.wubo@huawei.com>
     Editor: Guangying Zheng <zhengguangying@huawei.com>";
  description
    "This module provides configuration of TACACS+ client.

     The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL
     NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED',
     'MAY', and 'OPTIONAL' in this document are to be interpreted as
     described in BCP 14 (RFC 2119) (RFC 8174) when, and only when,
     they appear in all capitals, as shown here.

     Copyright (c) 2021 IETF Trust and the persons identified as
     authors of the code.  All rights reserved.

     Redistribution and use in source and binary forms, with or
     without modification, is permitted pursuant to, and subject
     to the license terms contained in, the Simplified BSD License
     set forth in Section 4.c of the IETF Trust's Legal Provisions
     Relating to IETF Documents
     (https://trustee.ietf.org/license-info).

     This version of this YANG module is part of RFC 9105; see the
     RFC itself for full legal notices.";

  revision 2021-08-05 {
    description
      "Initial revision.";
    reference
      "RFC 9105: A YANG Data Model for Terminal Access Controller
       Access-Control System Plus (TACACS+)";
  }

  typedef tacacs-plus-server-type {
    type bits {
      bit authentication {
        description
          "Indicates that the TACACS+ server is providing
           authentication services.";
      }
      bit authorization {
        description
          "Indicates that the TACACS+ server is providing
           authorization services.";
      }
      bit accounting {
        description
          "Indicates that the TACACS+ server is providing accounting
           services.";
      }
    }
    description
      "tacacs-plus-server-type can be set to
       authentication/authorization/accounting
       or any combination of the three types.";
  }

  identity tacacs-plus {
    base sys:authentication-method;
    description
      "Indicates AAA operation using TACACS+.";
    reference
      "RFC 8907: The TACACS+ Protocol";
  }

  grouping statistics {
    description
      "Grouping for TACACS+ statistics attributes.";
    container statistics {
      config false;
      description
        "A collection of server-related statistics objects.";
      leaf connection-opens {
        type yang:counter64;
        description
          "Number of new connection requests sent to the server,
           e.g., socket open.";
      }
      leaf connection-closes {
        type yang:counter64;
        description
          "Number of connection close requests sent to the server,
           e.g., socket close.";
      }
      leaf connection-aborts {
        type yang:counter64;
        description
          "Number of aborted connections to the server.  These do
           not include connections that are closed gracefully.";
      }
      leaf connection-failures {
        type yang:counter64;
        description
          "Number of connection failures to the server.";
      }
      leaf connection-timeouts {
        type yang:counter64;
        description
          "Number of connection timeouts to the server.";
      }
      leaf messages-sent {
        type yang:counter64;
        description
          "Number of messages sent to the server.";
      }
      leaf messages-received {
        type yang:counter64;
        description
          "Number of messages received from the server.";
      }
      leaf errors-received {
        type yang:counter64;
        description
          "Number of error messages received from the server.";
      }
      leaf sessions {
        type yang:counter64;
        description
          "Number of TACACS+ sessions completed with the server.
           If the Single Connection Mode was NOT enabled, the number
           of sessions is the same as the number of
           'connection-closes'.  If the Mode was enabled, a single
           TCP connection may contain multiple TACACS+ sessions.";
      }
    }
  }

  grouping tacacs-plus {
    description
      "Grouping for TACACS+ attributes.";
    container tacacs-plus {
      must "not(derived-from-or-self(../sys:authentication"
         + "/sys:user-authentication-order, 'tacacs-plus'))"
         + " or bit-is-set(server/server-type,'authentication')" {
        error-message "When 'tacacs-plus' is used as a system"
                    + " authentication method, a TACACS+"
                    + " authentication server must be configured.";
        description
          "When 'tacacs-plus' is used as an authentication method,
           a TACACS+ server must be configured.";
      }
      description
        "Container for TACACS+ configurations and operations.";
      list server {
        key "name";
        ordered-by user;
        description
          "List of TACACS+ servers used by the device.";
        leaf name {
          type string;
          description
            "An arbitrary name for the TACACS+ server.";
        }
        leaf server-type {
          type tacacs-plus-server-type;
          mandatory true;
          description
            "Server type: authentication/authorization/accounting and
             various combinations.";
        }
        leaf address {
          type inet:host;
          mandatory true;
          description
            "The address of the TACACS+ server.";
        }
        leaf port {
          type inet:port-number;
          default "49";
          description
            "The port number of TACACS+ Server port.";
        }
        choice security {
          mandatory true;
          description
            "Security mechanism between TACACS+ client and server.
             This is modeled as a YANG 'choice' so that it can be
             augmented by a YANG module in a backwards-compatible
             manner.";
          case obfuscation {
            leaf shared-secret {
              type string {
                length "1..max";
              }
              nacm:default-deny-all;
              description
                "The shared secret, which is known to both the
                 TACACS+ client and server.  TACACS+ server
                 administrators SHOULD configure a shared secret with
                 a minimum length of 16 characters.
                 It is highly recommended that this shared secret is
                 at least 32 characters long and sufficiently complex
                 with a mix of different character types,
                 i.e., upper case, lower case, numeric, and
                 punctuation.  Note that this security mechanism is
                 best described as 'obfuscation' and not 'encryption'
                 as it does not provide any meaningful integrity,
                 privacy, or replay protection.";
              reference
                "RFC 8907: The TACACS+ Protocol";
            }
          }
        }
        choice source-type {
          description
            "The source address type for outbound TACACS+ packets.";
          case source-ip {
            leaf source-ip {
              type inet:ip-address;
              description
                "Specifies source IP address for TACACS+ outbound
                 packets.";
            }
          }
          case source-interface {
            leaf source-interface {
              type if:interface-ref;
              description
                "Specifies the interface from which the IP address
                 is derived for use as the source for the outbound
                 TACACS+ packet.";
            }
          }
        }
        leaf vrf-instance {
          type leafref {
            path "/ni:network-instances/ni:network-instance/ni:name";
          }
          description
            "Specifies the VPN Routing and Forwarding (VRF) instance
             to use to communicate with the TACACS+ server.";
          reference
            "RFC 8529: YANG Data Model for Network Instances";
        }
        leaf single-connection {
          type boolean;
          default "false";
          description
            "Indicates whether the Single Connection Mode is enabled
             for the server.  By default, the Single Connection Mode
             is disabled.";
        }
        leaf timeout {
          type uint16 {
            range "1..max";
          }
          units "seconds";
          default "5";
          description
            "The number of seconds the device will wait for a
             response from each TACACS+ server before trying with a
             different server.";
        }
        uses statistics;
      }
    }
  }

  augment "/sys:system" {
    description
      "Augments the system model with the tacacs-plus model.";
    uses tacacs-plus;
  }
}

   {
     "ietf-system:system": {
       "authentication": {
         "user-authentication-order": [tacacs-plus, local-users]
       }
       "tacacs-plus": {
         "server": [
           {
             "name": "tac_plus1",
             "server-type": "authentication",
             "address": "192.0.2.2",
             "shared-secret": "QaEfThUkO198010075460923+h3TbE8n",
             "source-ip": "192.0.2.12",
             "timeout": "10"
           }
         ]
       }
     }
   }