Feedback
Contents
Configuring Primary Authentication
This chapter includes the following sections:
- Primary Authentication
- Remote Authentication Providers
- Selecting a Primary Authentication Service
- Creating an LDAP Provider
- Creating a RADIUS Provider
- Creating a TACACS+ Provider
- Deleting an LDAP Provider
- Deleting a RADIUS Provider
- Deleting a TACACS+ Provider
Primary Authentication
Remote Authentication Providers
If a system is configured for one of the supported remote authentication services, you must create a provider for that service to ensure that Cisco UCS Manager can communicate with it. In addition, you need to be aware of the following guidelines that impact user authorization:
User Accounts in Remote Authentication Services
You can create user accounts in Cisco UCS Manager or in the remote authentication server.
The temporary sessions for users who log in through remote authentication services can be viewed through Cisco UCS Manager GUI or Cisco UCS Manager CLI.
User Roles and Related Attributes in Remote Authentication Services
If you create user accounts in the remote authentication server, you must ensure that the accounts include the roles those users require for working in Cisco UCS Manager and that the names of those roles match the names used in Cisco UCS Manager. If an account does not have the required roles, the user is granted only read-only privileges.
The following table contains the name of the attribute that contains the value of the roles. Cisco UCS Manager checks for the value of this attribute when it queries the remote authentication service during login.
NoteYou cannot use any other attribute in the remote authentication service for the Cisco UCS roles. You must create the attribute required for that specific remote authentication service.
Remote Authentication Protocol
Attribute Name
LDAP
CiscoAVPair
RADIUS
cisco-av-pair
TACACS+
cisco-av-pair
For LDAP, the following is the full definition for the CiscoAVPair OID:
CN=CiscoAVPair,CN=Schema,CN=Configuration,CN=X objectClass: top objectClass: attributeSchema cn: CiscoAVPair distinguishedName: CN=CiscoAVPair,CN=Schema,CN=Configuration,CN=X instanceType: 0x4 uSNCreated: 26318654 attributeID: 1.3.6.1.4.1.9.287247.1 attributeSyntax: 2.5.5.12 isSingleValued: TRUE showInAdvancedViewOnly: TRUE adminDisplayName: CiscoAVPair adminDescription: UCS User Authorization Field oMSyntax: 64 lDAPDisplayName: CiscoAVPair name: CiscoAVPair objectCategory: CN=Attribute-Schema,CN=Schema,CN=Configuration,CN=XCreating a Remote Authentication Provider
Creating an LDAP Provider
Before You BeginProcedurePerform the following configuration in the LDAP server:
Create a CiscoAVPair attribute with an attribute ID of 1.3.6.1.4.1.9.287247.1. You cannot use an existing LDAP attribute.
For a cluster configuration, add the management port IP addresses for both fabric interconnects. This configuration ensures that remote users can continue to log in if the first fabric interconnect fails and the system fails over to the second fabric interconnect. All log-in requests are sourced from these IP addresses, not the virtual IP address used by Cisco UCS Manager.
What to Do Next
Select LDAP as the primary authentication service. For more information, see Selecting a Primary Authentication Service.
Creating a RADIUS Provider
Before You BeginProcedurePerform the following configuration in the RADIUS server:
Create the cisco-av-pairs attribute. You cannot use an existing RADIUS attribute.
For a cluster configuration, add the management port IP addresses for both fabric interconnects. This configuration ensures that remote users can continue to log in if the first fabric interconnect fails and the system fails over to the second fabric interconnect. All log-in requests are sourced from these IP addresses, not the virtual IP address used by Cisco UCS Manager.
Step 1 In the Navigation pane, click the Admin tab. Step 2 In the Admin tab, expand . Step 3 Complete the following fields in the Properties area:
Name Description Timeout field
The length of time in seconds the system should spend trying to contact the RADIUS database before it times out.
Enter a value from 1 to 60 seconds. The default value is 5 seconds.
Retries field
The number of times to retry the connection before the request is considered to have failed.
States Section
Current Task field
This field shows the task that is executing on behalf of this component. For details, see the associated FSM tab.
Note If there is no current task, this field is not displayed.
Step 4 In the Actions area of the General tab, click Create RADIUS Provider. Step 5 In the Create RADIUS Provider dialog box:
Step 6 Click Save Changes.
What to Do Next
Select RADIUS as the primary authentication service. For more information, see Selecting a Primary Authentication Service.
Creating a TACACS+ Provider
Before You BeginProcedurePerform the following configuration in the TACACS+ server:
Create the cisco-av-pairs attribute. You cannot use an existing TACACS+ attribute.
For a cluster configuration, add the management port IP addresses for both fabric interconnects. This configuration ensures that remote users can continue to log in if the first fabric interconnect fails and the system fails over to the second fabric interconnect. All log-in requests are sourced from these IP addresses, not the virtual IP address used by Cisco UCS Manager.
Step 1 In the Navigation pane, click the Admin tab. Step 2 In the Admin tab, expand . Step 3 Complete the following field in the Properties area: Step 4 In the Actions area of the General tab, click Create TACACS Provider. Step 5 In the Create TACACS+ Provider dialog box:
Step 6 Click Save Changes.
What to Do Next
Select TACACS as the primary authentication service. For more information, see Selecting a Primary Authentication Service.
Deleting a Remote Authentication Provider
Selecting a Primary Authentication Service
Before You BeginProcedureIf the system uses a remote authentication service, create a provider for that authentication service. If you chose console, you do not need to create a provider first.
Step 1 In the Navigation pane, click the Admin tab. Step 2 In the Admin tab, expand . Step 3 On the General tab, click the radio button for the primary authentication method you want to use. Step 4 Click Save Changes.
