PDF

Local user configuration

Updated: April 15, 2026

Want to summarize with AI?

Log in

Describes how to configure local user accounts with granular, role-based access control for system management.

A local user is a system account that

  • provides authenticated access to the system with assigned roles and privileges

  • supports granular, role-based access control where accounts can be created with various roles including non-admin users with fewer privileges, and

  • exists in addition to the initial admin account that is configured in the initial configuration script when the system starts.

Local user access control

The APIC supports a granular, role-based access control system where user accounts can be created with various roles including non-admin users with fewer privileges.

Configure a local user using the GUI

Configure a local user account to provide authenticated access to the APIC system with specified security domain permissions and role privileges.

Local user accounts provide direct authentication to the APIC system without requiring external authentication servers. Each local user is assigned to specific security domains and granted role-based privileges that control their access permissions within the fabric.

Before you begin

  • The ACI fabric is installed, APIC controllers are online, and the APIC cluster is formed and healthy.

  • As appropriate, the security domain(s) that the user will access are defined. For example, if the new user account will be restricted to accessing a tenant, the tenant domain is tagged accordingly.

  • An APIC user account is available that will enable the following:

    • Creating the TACACS+ provider.

    • Creating the local user account in the target security domain(s). If the target domain is all, the login account used to create the new local user must be a fabric-wide administrator that has access to all. If the target domain is a tenant, the login account used to create the new local user must be a tenant administrator that has full read write access rights to the target tenant domain.

Follow these steps to configure a local user using the GUI:

Procedure

  1. On the menu bar, choose Admin > AAA.

  2. In the Navigation pane, click Users.

    In the Work pane, verify that you are in the Local Users tab.

  3. In the Work pane, click the task icon drop-down list and select Create Local User.

  4. In the STEP 1 > User Identity dialog box, perform these actions:

    1. In the Login ID field, add an ID.

      The login ID must meet these guidelines:

      • Must be unique within APIC.

      • Must begin with a letter.

      • Can contain between 1 and 32 characters.

      • Can include alphanumeric characters, underscores, dashes, and dots.

      After creating a user account, you cannot change the login ID. You must delete the user account and create a new one.

    2. In the Password field, enter the password.

      At the time a user sets their password, the Cisco APIC validates it against these criteria:

      • Minimum password length is 8 characters.

      • Maximum password length is 64 characters.

      • Has fewer than three consecutive repeated characters.

      • Can only contain ascii characters.

      • (Until R6.1.1) Password must include characters from at least three of these character types: lowercase letters, uppercase letters, digits, and symbols.

      • (From R6.1.2) Depending on the conditions of the password strength check, these requirements must be met:

        • If default conditions are enabled:

          • Password must include characters from at least three of these character types: lowercase letters, uppercase letters, digits, and symbols. From R6.1.3, password must specifically contain characters from all three of these character types: lowercase letters, digits, and symbols.

        • If custom conditions are enabled, select at least three of these conditions:

          • Password must include at least one uppercase letter.

          • Password must include at least one lowercase letter.

          • Password must include at least one digit.

          • Password must include at least one symbol.

          • Password must not contain any character repeated more than three times consecutively.

          • Password must not include more than three consecutive characters from the QWERTY keyboard layout. This is applicable only to these character types: lower case letters, upper case letters, and digits.

      • Does not use easily guessed passwords.

      • Cannot be the username or the reverse of the username.

      • Cannot be any variation of cisco, isco or any permutation of these characters or variants obtained by changing the capitalization of letters therein.

    3. In the Confirm Password field, confirm the password.
    4. Optional: For Certificate based authentication, in the User Certificate Attribute field, enter the user identity from the authentication certificate.
    5. Click Next.

  5. You can activate or deactivate the user account by using the Account Status control, and you can set an expiration date by using the Account Expires control.

  6. In the STEP 2 > Security dialog box, under Security Domain, choose the desired security domain for the user, and click Next.

  7. In the STEP 3 > Roles dialog box, perform these actions:

    1. Click the + to associate the user with a domain.
    2. From the drop-down lists, choose a Role Name and a Role Privilege Type for the user.
    3. click Update

    You can provide read-only or read/write privileges.

  8. click Finish

The local user account is created with the specified login credentials, security domain assignment, and role privileges. The user can now authenticate to the APIC system using their login ID and password.

Configure SSH public key authentication using the GUI

SSH public key authentication provides a more secure method of logging in to a server compared to password-based authentication. This task enables you to set up SSH public key authentication for local users through the GUI interface.

SSH public key authentication uses a pair of keys (public and private) to authenticate users. The public key is stored on the server, while the private key remains with the user. This method enhances security by eliminating the need to transmit passwords over the network.

Before you begin

  • Create a local user account in the target security domain(s). If the target domain is all, the login account used to create the new local user must be a fabric-wide administrator that has access to all. If the target domain is a tenant, the login account used to create the new local user must be a tenant administrator that has full read write access rights to the target tenant domain.

  • Generate a public key using the Unix command SSH-keygen .

    The default login domain must be set to local

Follow these steps to configure SSH public key authentication using the GUI:

Procedure

  1. On the menu bar, choose Admin > Users and confirm you are in the Local tab.

  2. In the Work pane, click the name of the user that you previously created.

    A window is displayed on the right with information about the user.

  3. Click the Details icon, The window displays user information and SSH Authorization details for configuring public key authentication., and the user details are displayed on a new screen.

    Scroll down to see the SSH Authorization details.

  4. Click the Edit icon, The window displays user information and SSH Authorization details, guiding the user to create an SSH Private Key File for download., and the Edit Local User screen is displayed. You can change the SSH details as required.

    Note

    To create the SSH Private Key File for downloading to a remote location, in the menu bar, expand Firmware > Download Tasks.

  5. Click Save.

SSH public key authentication is now configured for the selected local user. The user can authenticate using their private key instead of a password when connecting to the system.