Configuring Authentication

This chapter includes the following sections:

Authentication Services

Cisco UCS supports two methods to authenticate user logins:

  • Through user accounts local to Cisco UCS Manager

  • Remotely through one of the following protocols:

    • LDAP

    • RADIUS

    • TACACS+

Guidelines and Recommendations for Remote Authentication Providers

If a system is configured for one of the supported remote authentication services, you must create a provider for that service to ensure that Cisco UCS Manager can communicate with it. In addition, you need to be aware of the following guidelines that impact user authorization:

User Accounts in Remote Authentication Services

User accounts can exist locally in Cisco UCS Manager or in the remote authentication server.

The temporary sessions for users who log in through remote authentication services can be viewed through Cisco UCS Manager GUI or Cisco UCS Manager CLI.

User Roles in Remote Authentication Services

If you create user accounts in the remote authentication server, you must ensure that the accounts include the roles those users require for working in Cisco UCS Manager and that the names of those roles match the names used in Cisco UCS Manager. Depending on the role policy, a user may not be allowed to log in or will be granted only read-only privileges.

User Attributes in Remote Authentication Providers

For RADIUS and TACACS+ configurations, you must configure a user attribute for Cisco UCS in each remote authentication provider through which users log in to Cisco UCS Manager. This user attribute holds the roles and locales assigned to each user.


Note

This step is not required for LDAP configurations that use LDAP Group Mapping to assign roles and locales.

When a user logs in, Cisco UCS Manager does the following:

  1. Queries the remote authentication service.

  2. Validates the user.

  3. If the user is validated, checks for the roles and locales assigned to that user.

The following table contains a comparison of the user attribute requirements for the remote authentication providers supported by Cisco UCS.

Table 1 Comparison of User Attributes by Remote Authentication Provider
Authentication Provider Custom Attribute Schema Extension Attribute ID Requirements

LDAP

Not required if group mapping is used

Optional if group mapping is not used

Optional. You can choose to do either of the following:

  • Do not extend the LDAP schema and configure an existing, unused attribute that meets the requirements.

  • Extend the LDAP schema and create a custom attribute with a unique name, such as CiscoAVPair.

The Cisco LDAP implementation requires a unicode type attribute.

If you choose to create the CiscoAVPair custom attribute, use the following attribute ID: 1.3.6.1.4.1.9.287247.1

A sample OID is provided in the following section.

RADIUS

Optional

Optional. You can choose to do either of the following:

  • Do not extend the RADIUS schema and use an existing, unused attribute that meets the requirements.

  • Extend the RADIUS schema and create a custom attribute with a unique name, such as cisco-avpair.

The vendor ID for the Cisco RADIUS implementation is 009 and the vendor ID for the attribute is 001.

The following syntax example shows how to specify multiples user roles and locales if you choose to create the cisco-avpair attribute: shell:roles="admin,aaa" shell:locales="L1,abc". Use a comma "," as the delimiter to separate multiple values.

TACACS+

Required

Required. You must extend the schema and create a custom attribute with the name cisco-av-pair.

The cisco-av-pair name is the string that provides the attribute ID for the TACACS+ provider.

The following syntax example shows how to specify multiples user roles and locales when you create the cisco-av-pair attribute: cisco-av-pair=shell:roles="admin aaa" shell:locales*"L1 abc". Using an asterisk (*) in the cisco-av-pair attribute syntax flags the locale as optional, preventing authentication failures for other Cisco devices that use the same authorization profile. Use a space as the delimiter to separate multiple values.

Sample OID for LDAP User Attribute

The following is a sample OID for a custom CiscoAVPair attribute:

CN=CiscoAVPair,CN=Schema,
CN=Configuration,CN=X
objectClass: top
objectClass: attributeSchema
cn: CiscoAVPair
distinguishedName: CN=CiscoAVPair,CN=Schema,CN=Configuration,CN=X
instanceType: 0x4
uSNCreated: 26318654
attributeID: 1.3.6.1.4.1.9.287247.1
attributeSyntax: 2.5.5.12
isSingleValued: TRUE
showInAdvancedViewOnly: TRUE
adminDisplayName: CiscoAVPair
adminDescription: UCS User Authorization Field
oMSyntax: 64
lDAPDisplayName: CiscoAVPair
name: CiscoAVPair
objectCategory: CN=Attribute-Schema,CN=Schema,CN=Configuration,CN=X

Two Factor Authentication

Cisco UCS Manager supports user login actions with a combination of a user name and a password. Users may set passwords that are easy for them to remember, but which may be weak enough to be exploited by malware, spyware, or computer viruses. Users who access the system remotely from unsecured networks, or are using an unsecured service, can have their passwords compromised by snooping software. Phishing attacks are viruses that may trick users into revealing their passwords.

A way to strengthen user authentication is to require a second factor in addition to a username and password. Two-factor authentication requires two of three authentication factors. It employs a combination of something a user knows, for example, a password or a PIN, and something a user has, for example, a certificate or token. Two-factor authentication is only supported for remote users, and does not support IPMI.

Cisco UCS Manager provides two-factor authentication by employing authentication applications that maintain token servers to generate one-time tokens for users during the login process. Passwords are stored in the AAA server, so when users log in, they have to enter their user name, then enter a token and password combination in the password field. Requests are sent to the token server to retrieve a vendor specific attribute. Cisco UCS Manager expects the token server to be integrated with the AAA server so it forwards the request to the AAA server. The password and token are validated at the same time by the AAA server. Users need to enter the token and password sequence in the same order as it is configured in the AAA server.

This feature is supported by associating RADIUS or TACACS+ provider groups with designated authentication domains and enabling two-factor authentication for those domains.


Note

Two-factor authentication is not supported when the authentication realm is set to LDAP, local, or none.

Web Session Refresh and Web Session Timeout Period

The web session timeout period controls the maximum length of time a session is maintained, regardless of activity. The web session timeout period is also set to a higher default value when you configure two-factor authentication. When the web session refresh period expires, the Cisco UCS Manager GUI client automatically generates a prompt for the user to enter a new token and password combination.

The web session refresh period controls how long a user's web session remains valid. When two-factor authentication is configured, users have to enter a token and password combination and log in at the expiration of every web session refresh period. To avoid frequent session timeouts that would require users to regenerate and re-enter a token and password many times, the web session refresh period is set to a higher initial default value when you enable two-factor authentication. This allows remote users to maintain active sessions for longer periods of time. If the web session refresh expires due to inactivity, users will be prompted to generate a new token and log in again.

LDAP Group Rule

The LDAP group rule is used to determine whether Cisco UCS should use LDAP groups when assigning user roles and locales to a remote user.

Nested LDAP Groups

Beginning with Cisco UCS Manager release 2.1(2), you can search LDAP groups that are nested within another group defined in an LDAP group map. With this new capability, you do not always need to create subgroups in a group map in Cisco UCS Manager.

Note

Nested LDAP search support is supported only for Microsoft Active Directory servers. The supported versions are Microsoft Windows 2003 SP3, Microsoft Windows 2008 R2, and Microsoft Windows 2012.

Using the LDAP nesting feature, you can add an LDAP group as a member of another group and nest groups to consolidate member accounts and reduce the replication of traffic.

Be default, user rights are inherited when you nest an LDAP group within another group. For example, if you make Group_1 a member of Group_2, the users in Group_1 will have the same permissions as the members of Group_2. You can then search users that are members of Group_1 by choosing only Group_2 in the LDAP group map, instead of having to seach Group_1 and Group_2 separately.

Configuring LDAP Providers

Configuring Properties for LDAP Providers

The properties that you configure in this task are the default settings for all provider connections of this type defined in Cisco UCS Manager. If an individual provider includes a setting for any of these properties, Cisco UCS uses that setting and ignores the default setting.

Before You Begin

If you are using Active Directory as your LDAP server, create a user account in the Active Directory server to bind with Cisco UCS. This account should be given a non-expiring password.

Procedure
    Step 1   In the Navigation pane, click the Admin tab.
    Step 2   On the Admin tab, expand All > User Management > LDAP.
    Step 3   In the Properties area, complete all fields.
    Note   

    User login will fail if the userdn for an LDAP user exceeds 255 characters.

    Step 4   Click Save Changes.
    What to Do Next

    Create an LDAP provider.

    Creating an LDAP Provider

    Cisco UCS Manager supports a maximum of 16 LDAP providers.

    Before You Begin

    If you are using Active Directory as your LDAP server, create a user account in the Active Directory server to bind with Cisco UCS. This account should be given a non-expiring password.

    • In the LDAP server, perform one of the following configurations:

      • Configure LDAP groups. LDAP groups contain user role and locale information.

      • Configure users with the attribute that holds the user role and locale information for Cisco UCS Manager. You can choose whether to extend the LDAP schema for this attribute. If you do not want to extend the schema, use an existing LDAP attribute to hold the Cisco UCS user roles and locales. If you prefer to extend the schema, create a custom attribute, such as the CiscoAVPair attribute.

        The Cisco LDAP implementation requires a unicode type attribute.

        If you choose to create the CiscoAVPair custom attribute, use the following attribute ID: 1.3.6.1.4.1.9.287247.1

      • For a cluster configuration, add the management port IPv4 or IPv6 addresses for both fabric interconnects. This configuration ensures that remote users can continue to log in if the first fabric interconnect fails and the system fails over to the second fabric interconnect. All login requests are sourced from these IP addresses, not the virtual IPv4 or IPv6 address used by Cisco UCS Manager.

    • If you want to use secure communications, create a trusted point containing the certificate of the root certificate authority (CA) of the LDAP server in Cisco UCS Manager.

    • If you need to change the LDAP providers or add or delete them, you need to change the authentication realm for the domain to local, make the changes to the providers, and then change the domain authentication realm back to LDAP.

    Attention:

    Note that LDAP remote user names that include special characters cannot login to systems that are running versions 2.2(3a) and later. The user cannot login because of the Nexus OS limitations where special characters, !,%,^, are not supported in the user name.

    Procedure
      Step 1   In the Navigation pane, click the Admin tab.
      Step 2   On the Admin tab, expand All > User Management > LDAP.
      Step 3   In the Work pane, click the General tab.
      Step 4   In the Actions area, click Create LDAP Provider.
      Step 5   On the Create LDAP Provider page of the wizard, complete all fields with appropriate LDAP service information.
      Note   

      If you use a hostname rather than an IPv4 or IPv6 address, you must ensure a DNS server is configured for the hostname.

      Step 6   On the LDAP Group Rule page of the wizard, complete all fields with appropriate LDAP group rule information.
      Note   

      Role and locale assignment is cumulative. If a user is included in multiple groups, or has a role or locale specified in the LDAP attribute, Cisco UCS assigns that user all the roles and locales mapped to any of those groups or attributes.

      What to Do Next

      For implementations involving a single LDAP database, select LDAP as the authentication service.

      For implementations involving multiple LDAP databases, configure an LDAP provider group.

      Changing the LDAP Group Rule for an LDAP Provider

      Procedure
        Step 1   In the Navigation pane, click the Admin tab.
        Step 2   On the Admin tab, expand All > User Management > LDAP.
        Step 3   Expand LDAP Providers and choose the LDAP provider for which you want to change the group rule.
        Step 4   In the Work pane, click the General tab.
        Step 5   In the LDAP Group Rules area, complete the following fields:
        Name Description

        Group Authorization field

        Whether Cisco UCS also searches LDAP groups when authenticating and assigning user roles and locales to remote users. This can be one of the following:

        • Disable—Cisco UCS does not access any LDAP groups.

        • Enable—Cisco UCS searches all LDAP groups mapped in this Cisco UCS domain. If the remote user is found, Cisco UCS assigns the user roles and locales defined for that LDAP group in the associated LDAP group map.

        Note   

        Role and locale assignment is cumulative. If a user is included in multiple groups, or has a role or locale specified in the LDAP attribute, Cisco UCS assigns that user all the roles and locales mapped to any of those groups or attributes.

        Group Recursion field

        Whether Cisco UCS searches both the mapped groups and their parent groups. This can be one of the following:

        • Non Recursive—Cisco UCS searches only the groups mapped in this Cisco UCS domain. If none of the groups containing the user explicitly set the user's authorization properties, Cisco UCS uses the default settings.

        • Recursive—Cisco UCS searches each mapped group and all its parent groups for the user's authorization properties. These properties are cumulative, so for each group Cisco UCS finds with explicit authorization property settings, it applies those settings to the current user. Otherwise it uses the default settings.

        Target Attribute field

        The attribute Cisco UCS uses to determine group membership in the LDAP database.

        The supported string length is 63 characters. The default string is memberOf.

        Use Primary Group field

        The attribute Cisco UCS uses to determine if the primary group can be configured as an LDAP group map for membership validation. With this option Cisco UCS Manager can download and verify the primary-group membership of the user.

        Step 6   Click Save Changes.

        Deleting an LDAP Provider

        Procedure
          Step 1   In the Navigation pane, click the Admin tab.
          Step 2   On the Admin tab, expand All > User Management > LDAP.
          Step 3   Expand LDAP Providers.
          Step 4   Right-click the LDAP provider you want to delete and choose Delete.
          Step 5   If the Cisco UCS Manager GUI displays a confirmation dialog box, click Yes.

          LDAP Group Mapping

          For organizations that already use LDAP groups to restrict access to LDAP databases, group membership information can be used by UCSM to assign a role or locale to an LDAP user during login. This eliminates the need to define role or locale information in the LDAP user object when Cisco UCS Manager is deployed.

          When a user logs in to Cisco UCS Manager, information about the user's role and locale are pulled from the LDAP group map. If the role and locale criteria match the information in the policy, access is granted.

          Role and locale definitions are configured locally in Cisco UCS Manager and do not update automatically based on changes to an LDAP directory. When deleting or renaming LDAP groups in an LDAP directory, it is important that you update Cisco UCS Manager with the change.

          An LDAP group map can be configured to include any of the following combinations of roles and locales:

          • Roles only

          • Locales only

          • Both roles and locales

          For example, consider an LDAP group representing a group of server administrators at a specific location. The LDAP group map might be configured to include user roles like server-profile and server-equipment. To restrict access to server administrators at a specific location, the locale could be set to a particular site name.

          Note

          Cisco UCS Manager includes many out-of-the-box user roles but does not include any locales. Mapping an LDAP provider group to a locale requires that you create a custom locale.

          Creating an LDAP Group Map

          Before You Begin

          • Create an LDAP group in the LDAP server.

          • Configure the distinguished name for the LDAP group in the LDAP server.

          • Create locales in Cisco UCS Manager (optional).

          • Create custom roles in Cisco UCS Manager (optional).

          Procedure
            Step 1   In the Navigation pane, click the Admin tab.
            Step 2   On the Admin tab, expand All > User Management > LDAP.
            Step 3   Right-click LDAP Group Maps and choose Create LDAP Group Map.
            Step 4   In the Create LDAP Group Map dialog box, specify all LDAP group map information, as appropriate.
            Important: The name specified in the LDAP Group DN field must match the name in the LDAP database exactly.
            Note   

            If you plan to use a special character in the LDAP Group DN field, you need to prefix the special character with an escape character \ (single back slash).

            What to Do Next

            Set the LDAP group rule.

            Deleting an LDAP Group Map

            Procedure
              Step 1   In the Navigation pane, click the Admin tab.
              Step 2   On the Admin tab, expand All > User Management > LDAP.
              Step 3   Expand LDAP Group Maps.
              Step 4   Right-click the LDAP group map you want to delete and choose Delete.
              Step 5   If the Cisco UCS Manager GUI displays a confirmation dialog box, click Yes.

              Configuring RADIUS Providers

              Configuring Properties for RADIUS Providers

              The properties that you configure in this task are the default settings for all provider connections of this type defined in Cisco UCS Manager. If an individual provider includes a setting for any of these properties, Cisco UCS uses that setting and ignores the default setting.

              Procedure
                Step 1   In the Navigation pane, click the Admin tab.
                Step 2   In the Admin tab, expand User Management > RADIUS.
                Step 3   In the Properties area, complete all fields.
                Step 4   Click Save Changes.
                What to Do Next

                Create a RADIUS provider.

                Creating a RADIUS Provider

                Cisco UCS Manager supports a maximum of 16 RADIUS providers.

                Before You Begin

                Perform the following configuration in the RADIUS server:

                • Configure users with the attribute that holds the user role and locale information for Cisco UCS Manager. You can choose whether to extend the RADIUS schema for this attribute. If you do not want to extend the schema, use an existing RADIUS attribute to hold the Cisco UCS user roles and locales. If you prefer to extend the schema, create a custom attribute, such as the cisco-avpair attribute.

                  The vendor ID for the Cisco RADIUS implementation is 009 and the vendor ID for the attribute is 001.

                  The following syntax example shows how to specify multiples user roles and locales if you choose to create the cisco-avpair attribute: shell:roles="admin,aaa" shell:locales="L1,abc". Use a comma "," as the delimiter to separate multiple values.

                • For a cluster configuration, add the management port IPv4 or IPv6 addresses for both fabric interconnects. This configuration ensures that remote users can continue to log in if the first fabric interconnect fails and the system fails over to the second fabric interconnect. All login requests are sourced from these IP addresses, not the virtual IP address used by Cisco UCS Manager.

                Procedure
                  Step 1   In the Navigation pane, click the Admin tab.
                  Step 2   On the Admin tab, expand All > User Management > RADIUS.
                  Step 3   In the Create RADIUS Provider dialog box, specify all appropriate RADIUS service information.
                  Note   

                  If you use a hostname rather than an IPv4 or IPv6 address, you must ensure a DNS server is configured for the hostname.

                  Step 4   Click Save Changes.
                  What to Do Next

                  For implementations involving a single RADIUS database, select RADIUS as the primary authentication service.

                  For implementations involving multiple RADIUS databases, configure a RADIUS provider group.

                  Deleting a RADIUS Provider

                  Procedure
                    Step 1   In the Navigation pane, click the Admin tab.
                    Step 2   In the Admin tab, expand User Management > RADIUS.
                    Step 3   Right-click the RADIUS provider you want to delete and choose Delete.
                    Step 4   If the Cisco UCS Manager GUI displays a confirmation dialog box, click Yes.

                    Configuring TACACS+ Providers

                    Configuring Properties for TACACS+ Providers

                    The properties that you configure in this task are the default settings for all provider connections of this type defined in Cisco UCS Manager. If an individual provider includes a setting for any of these properties, Cisco UCS uses that setting and ignores the default setting.

                    Procedure
                      Step 1   In the Navigation pane, click the Admin tab.
                      Step 2   In the Admin tab, expand User Management > TACACS+.
                      Step 3   In the Properties area, complete the Timeout field.
                      Step 4   Click Save Changes.
                      What to Do Next

                      Create an TACACS+ provider.

                      Creating a TACACS+ Provider

                      Cisco UCS Manager supports a maximum of 16 TACACS+ providers.

                      Before You Begin

                      Perform the following configuration in the TACACS+ server:

                      • Create the cisco-av-pair attribute. You cannot use an existing TACACS+ attribute.

                        The cisco-av-pair name is the string that provides the attribute ID for the TACACS+ provider.

                        The following syntax example shows how to specify multiples user roles and locales when you create the cisco-av-pair attribute: cisco-av-pair=shell:roles="admin aaa" shell:locales*"L1 abc". Using an asterisk (*) in the cisco-av-pair attribute syntax flags the locale as optional, preventing authentication failures for other Cisco devices that use the same authorization profile. Use a space as the delimiter to separate multiple values.

                      • For a cluster configuration, add the management port IPv4 or IPv6 addresses for both fabric interconnects. This configuration ensures that remote users can continue to log in if the first fabric interconnect fails and the system fails over to the second fabric interconnect. All login requests are sourced from these IP addresses, not the virtual IP address used by Cisco UCS Manager.

                      Procedure
                        Step 1   In the Navigation pane, click the Admin tab.
                        Step 2   On the Admin tab, expand All > User Management > TACACS+.
                        Step 3   In the Actions area of the General tab, click Create TACACS+ Provider.
                        Step 4   In the Create TACACS+ Provider dialog box:
                        1. Complete all fields with TACACS+ service information, as appropriate.
                          Note   

                          If you use a hostname rather than an IPv4 or IPv6 address, you must ensure a DNS server is configured for the hostname.

                        2. Click OK.
                        Step 5   Click Save Changes.
                        What to Do Next

                        For implementations involving a single TACACS+ database, select TACACS+ as the primary authentication service.

                        For implementations involving multiple TACACS+ databases, configure a TACACS+ provider group.

                        Deleting a TACACS+ Provider

                        Procedure
                          Step 1   In the Navigation pane, click the Admin tab.
                          Step 2   In the Admin tab, expand User Management > TACACS+.
                          Step 3   Right-click the TACACS+ provider you want to delete and choose Delete.
                          Step 4   If the Cisco UCS Manager GUI displays a confirmation dialog box, click Yes.

                          Configuring Multiple Authentication Systems

                          Multiple Authentication Systems

                          You can configure Cisco UCS to use multiple authentication systems by configuring the following features:

                          • Provider groups

                          • Authentication domains

                          Provider Groups

                          A provider group is a set of providers that are used by Cisco UCS during the authentication process. Cisco UCS Manager allows you to create a maximum of 16 provider groups, with a maximum of eight providers allowed per group.

                          During authentication, all the providers within a provider group are tried in order. If all of the configured servers are unavailable or unreachable, Cisco UCS Manager automatically falls back to the local authentication method using the local username and password.

                          Creating an LDAP Provider Group

                          Creating an LDAP provider group allows you to authenticate using multiple LDAP databases.

                          Note

                          Authenticating with a single LDAP database does not require you to set up an LDAP provider group.

                          Before You Begin

                          Create one or more LDAP providers.

                          Procedure
                            Step 1   In the Navigation pane, click the Admin tab.
                            Step 2   On the Admin tab, expand All > User Management > LDAP.
                            Step 3   Right-click LDAP Provider Groups and choose Create LDAP Provider Group.
                            Note   

                            If you use a hostname rather than an IPv4 or IPv6 address, you must ensure a DNS server is configured for the hostname.

                            Step 4   In the Create LDAP Provider Group dialog box, specify all appropriate LDAP provider group information.
                            What to Do Next

                            Configure an authentication domain or select a default authentication service.

                            Deleting an LDAP Provider Group

                            Before You Begin

                            Remove the provider group from an authentication configuration.

                            Procedure
                              Step 1   In the Navigation pane, click the Admin tab.
                              Step 2   On the Admin tab, expand All > User Management > LDAP.
                              Step 3   Expand LDAP Provider Groups.
                              Step 4   Right-click the LDAP provider group you want to delete and choose Delete.
                              Step 5   If the Cisco UCS Manager GUI displays a confirmation dialog box, click Yes.

                              Creating a RADIUS Provider Group

                              Creating a RADIUS provider group allows you to authenticate using multiple RADIUS databases.

                              Note

                              Authenticating with a single RADIUS database does not require you to set up a RADIUS provider group.

                              Before You Begin

                              Create one or more RADIUS providers.

                              Procedure
                                Step 1   In the Navigation pane, click the Admin tab.
                                Step 2   On the Admin tab, expand All > User Management > RADIUS.
                                Step 3   Right-click RADIUS Provider Groups and choose Create RADIUS Provider Group.
                                Step 4   In the Create RADIUS Provider Group dialog box, do the following:
                                1. In the Name field, enter a unique name for the group.

                                  This name can be between 1 and 127 ASCII characters.

                                2. In the RADIUS Providers table, choose one or more providers to include in the group.
                                3. Click the >> button to add the providers to the Included Providers table.

                                  You can use the << button to remove providers from the group.

                                4. (Optional) Use the Move Up or Move Down arrows in the Included Providers list to change the order in which the RADIUS providers will be accessed for authentication.
                                5. After you have added all desired providers to the provider group, click OK.
                                What to Do Next

                                Configure an authentication domain or select a default authentication service.

                                Deleting a RADIUS Provider Group

                                You cannot delete a provider group if it is being used by an authentication configuration.

                                Procedure
                                  Step 1   In the Navigation pane, click the Admin tab.
                                  Step 2   On the Admin tab, expand All > User Management > RADIUS.
                                  Step 3   Expand RADIUS Provider Groups.
                                  Step 4   Right-click the RADIUS provider group you want to delete and choose Delete.
                                  Step 5   If the Cisco UCS Manager GUI displays a confirmation dialog box, click Yes.

                                  Creating a TACACS+ Provider Group

                                  Creating a TACACS+ provider group allows you to authenticate using multiple TACACS+ databases.

                                  Note

                                  Authenticating with a single TACACS+ database does not require you to set up a TACACS+ provider group.

                                  Before You Begin

                                  Create one or more TACACS+ providers.

                                  Procedure
                                    Step 1   In the Navigation pane, click the Admin tab.
                                    Step 2   On the Admin tab, expand All > User Management > TACACS+.
                                    Step 3   Right-click TACACS+ Provider Groups and choose Create TACACS+ Provider Group.
                                    Step 4   In the Create TACACS+ Provider Group dialog box, specify all TACACS+ provider group information, as appropriate.

                                    Deleting a TACACS+ Provider Group

                                    You cannot delete a provider group if it is being used by an authentication configuration.

                                    Procedure
                                      Step 1   In the Navigation pane, click the Admin tab.
                                      Step 2   On the Admin tab, expand All > User Management > TACACS+.
                                      Step 3   Expand TACACS+ Provider Groups.
                                      Step 4   Right-click the TACACS+ provider group you want to delete and choose Delete.
                                      Step 5   If the Cisco UCS Manager GUI displays a confirmation dialog box, click Yes.

                                      Authentication Domains

                                      Authentication domains are used by Cisco UCS Manager to leverage multiple authentication systems. Each authentication domain is specified and configured during login. If no authentication domain is specified, the default authentication service configuration is used.

                                      You can create up to eight authentication domains. Each authentication domain is associated with a provider group and realm in Cisco UCS Manager. If no provider group is specified, all servers within the realm are used.

                                      Creating an Authentication Domain

                                      Procedure
                                        Step 1   In the Navigation pane, click the Admin tab.
                                        Step 2   On the Admin tab, expand All > User Management > Authentication.
                                        Step 3   Right-click Authentication Domains and choose Create a Domain.
                                        Step 4   In the Create a Domain dialog box, complete the following fields:
                                        Name Description

                                        Name field

                                        The name of the domain.

                                        This name can be between 1 and 16 alphanumeric characters. You cannot use spaces or any special characters other than - (hyphen), _ (underscore), : (colon), and . (period), and you cannot change this name after the object has been saved.

                                        Note   

                                        For systems using remote authentication protocol, the authentication domain name is considered part of the user name and counts toward the 32-character limit for locally created user names. Because Cisco UCS inserts 5 characters for formatting, authentication will fail if the domain name and user name combined character total exceeds 27.

                                        Web Session Refresh Period (sec) field

                                        When a web client connects to Cisco UCS Manager, the client needs to send refresh requests to Cisco UCS Manager to keep the web session active. This option specifies the maximum amount of time allowed between refresh requests for a user in this domain.

                                        If this time limit is exceeded, Cisco UCS Manager considers the web session to be inactive, but it does not terminate the session.

                                        Specify an integer between 60 and 172800. The default is 600 seconds.

                                        Note   

                                        The number of seconds set for the Web Session Refresh Period must be less than the number of seconds set for the Web Session Timeout. Do not set the Web Session Refresh Period to the same value as the Web Session Timeout.

                                        Web Session Timeout (sec) field

                                        The maximum amount of time that can elapse after the last refresh request before Cisco UCS Manager considers a web session to have ended. If this time limit is exceeded, Cisco UCS Manager automatically terminates the web session.

                                        Specify an integer between 60 and 172800. The default is 7200 seconds.

                                        Realm field

                                        The authentication protocol that will be applied to users in this domain. This can be one of the following:

                                        • Local—The user account must be defined locally in this Cisco UCS domain.

                                        • Radius—The user must be defined on the RADIUS server specified for this Cisco UCS domain.

                                        • Tacacs—The user must be defined on the TACACS+ server specified for this Cisco UCS domain.

                                        • Ldap—The user must be defined on the LDAP server specified for this Cisco UCS domain.

                                        Provider Group drop-down list

                                        The default provider group to be used to authenticate the user during remote login.

                                        Note   

                                        The Provider Group drop-down list is displayed when you select Ldap, Radius, or Tacacs as the method by which a user is authenticated.

                                        Two Factor Authentication checkbox

                                        Two Factor Authentication is available only when the Realm is set to Radius or Tacacs. When this checkbox is selected, Cisco UCS Manager and the KVM launch manager require users whose accounts are authenticated by Radius or Tacacs servers to enter a token plus a password to log in. When the Web Session Refresh Period expires, users must generate a new token and enter the token plus their password to continue the session.

                                        Step 5   Click OK.

                                        Selecting a Primary Authentication Service

                                        Selecting the Console Authentication Service

                                        Before You Begin

                                        If the system uses a remote authentication service, create a provider for that authentication service. If the system uses only local authentication through Cisco UCS, you do not need to create a provider first.

                                        Procedure
                                          Step 1   In the Navigation pane, click the Admin tab.
                                          Step 2   On the Admin tab, expand All > User Management > Authentication.
                                          Step 3   Click Native Authentication.
                                          Step 4   In the Work pane, click the General tab.
                                          Step 5   In the Console Authentication area, complete the following fields:
                                          Name Description

                                          Realm field

                                          The method by which a user logging into the console is authenticated. This can be one of the following:

                                          • Local—The user account must be defined locally in this Cisco UCS domain.

                                          • Radius—The user must be defined on the RADIUS server specified for this Cisco UCS domain.

                                          • Tacacs—The user must be defined on the TACACS+ server specified for this Cisco UCS domain.

                                          • Ldap—The user must be defined on the LDAP server specified for this Cisco UCS domain.

                                          • None—If the user account is local to this Cisco UCS domain, no password is required when the user logs into the console.

                                          Provider Group drop-down list

                                          The provider group to be used to authenticate a user logging into the console.

                                          Note   

                                          TheProvider Group drop-down list is displayed when you select Ldap, Radius, or Tacacs as the method by which a user is authenticated.

                                          Two Factor Authentication checkbox

                                          Two-factor authentication is available only when the Realm is set to Radius or Tacacs. When this checkbox is selected, the Console requires users whose accounts are authenticated by Radius or Tacacs servers to enter a token plus a password to log in.
                                          Step 6   Click Save Changes.

                                          Selecting the Default Authentication Service

                                          Before You Begin

                                          If the system uses a remote authentication service, create a provider for that authentication service. If the system uses only local authentication through Cisco UCS, you do not need to create a provider first.

                                          Procedure
                                            Step 1   In the Navigation pane, click the Admin tab.
                                            Step 2   On the Admin tab, expand All > User Management > Authentication.
                                            Step 3   Click Native Authentication.
                                            Step 4   In the Work pane, click the General tab.
                                            Step 5   In the Default Authentication area, complete the following fields:
                                            Name Description

                                            Realm drop-down list

                                            The default method by which a user is authenticated during remote login. This can be one of the following:

                                            • Local—The user account must be defined locally in this Cisco UCS domain.

                                            • Radius—The user account must be defined on the RADIUS server specified for this Cisco UCS domain.

                                            • Tacacs—The user account must be defined on the TACACS+ server specified for this Cisco UCS domain.

                                            • Ldap—The user account must be defined on the LDAP server specified for this Cisco UCS domain.

                                            • None—If the user account is local to this Cisco UCS domain, no password is required when the user logs in remotely.

                                            Provider Group drop-down list

                                            The default provider group to be used to authenticate the user during remote login.

                                            Note   

                                            The Provider Group drop-down is displayed when you select Ldap, Radius, or Tacacs as the method by which a user is authenticated.

                                            Web Session Refresh Period (sec) field

                                            When a web client connects to Cisco UCS Manager, the client needs to send refresh requests to Cisco UCS Manager to keep the web session active. This option specifies the maximum amount of time allowed between refresh requests for a user in this domain.

                                            If this time limit is exceeded, Cisco UCS Manager considers the web session to be inactive, but it does not terminate the session.

                                            Specify an integer between 60 and 172800. The default is 600 seconds.

                                            Web Session Timeout (sec) field

                                            The maximum amount of time that can elapse after the last refresh request before Cisco UCS Manager considers a web session to have ended. If this time limit is exceeded, Cisco UCS Manager automatically terminates the web session.

                                            Specify an integer between 60 and 172800. The default is 7200 seconds.

                                            Two Factor Authentication checkbox

                                            Two Factor Authentication is available only when the Realm is set to Radius or Tacacs. When this checkbox is selected, Cisco UCS Manager and the KVM launch manager require users whose accounts are authenticated by Radius or Tacacs servers to enter a token plus a password to log in. When the Web Session Refresh Period expires, users must generate a new token and enter the token plus their password to continue the session.

                                            Note   

                                            After you enable two factor authentication and save the configuration, the default Web Session Refresh Period (sec) field changes to 7200, and the default Web Session Timeout (sec) field changes to 8000.

                                            Step 6   Click Save Changes.

                                            Role Policy for Remote Users

                                            By default, if user roles are not configured in Cisco UCS Manager read-only access is granted to all users logging in to Cisco UCS Manager from a remote server using the LDAP, RADIUS, or TACACS protocols. For security reasons, it might be desirable to restrict access to those users matching an established user role in Cisco UCS Manager.

                                            You can configure the role policy for remote users in the following ways:
                                            assign-default-role

                                            Does not restrict user access to Cisco UCS Manager based on user roles. Read-only access is granted to all users unless other user roles have been defined in Cisco UCS Manager.

                                            This is the default behavior.

                                            no-login

                                            Restricts user access to Cisco UCS Manager based on user roles. If user roles have not been assigned for the remote authentication system, access is denied.

                                            Configuring the Role Policy for Remote Users

                                            Procedure
                                              Step 1   In the Navigation pane, click the Admin tab.
                                              Step 2   On the Admin tab, expand All > User Management > Authentication.
                                              Step 3   Click Native Authentication.
                                              Step 4   In the Work pane, click the General tab.
                                              Step 5   In the Role Policy for Remote Users field, click one of the following radio buttons to determine what happens when a user attempts to log in and the remote authentication provider does not supply a user role with the authentication information:

                                              • No Login—The user is not allowed to log in to the system, even if the username and password are correct.

                                              • Assign Default Role—The user is allowed to log in with a read-only user role.

                                              Step 6   Click Save Changes.