PDF

Configure windows server 2012 LDAP for APIC access with Cisco AVPair

Updated: April 15, 2026

Want to summarize with AI?

Log in

Configure Windows Server 2012 LDAP with Cisco AVPair attribute to enable Cisco APIC authentication and role-based access control for users.

This task enables Windows Server 2012 LDAP authentication for Cisco Application Policy Infrastructure Controller (Cisco APIC) by adding the CiscoAVPair attribute to the Active Directory schema and configuring user permissions with appropriate RBAC roles.

LDAP integration with Cisco APIC requires the CiscoAVPair attribute to be configured in the Windows Server 2012 Active Directory schema. This attribute enables assignment of Cisco APIC roles to LDAP users for role-based access control.

Before you begin

  • First, configure the LDAP server, then configure the Cisco Application Policy Infrastructure Controller (Cisco APIC) for LDAP access.

  • The Microsoft Windows Server 2012 is installed and online.

  • The Microsoft Windows Server 2012 Server Manager ADSI Edit tool is installed. To install ADSI Edit, follow the instructions in the Windows Server 2012 Server Manager help.

  • CiscoAVPair attribute specifications: Common Name = CiscoAVPair, LDAP Display Name = CiscoAVPair, Unique X500 Object ID = 1.3.6.1.4.1.9.22.1, Description = CiscoAVPair, Syntax = Case Sensitive String.

    Note

    For LDAP configurations, best practice is to use CiscoAVPair as the attribute string. If customer faces the issue using Object ID 1.3.6.1.4.1.9.22.1, an additional Object ID 1.3.6.1.4.1.9.2742.1-5 can also be used in the LDAP server.

  • A Microsoft Windows Server 2012 user account is available that will enable the following:

    • Running ADSI Edit to add the CiscoAVPair attribute to the Active Directory (AD) Schema.

    • Configuring an Active Directory LDAP user to have CiscoAVPair attribute permissions.

  • Port 636 is required for configuring LDAP integration with SSL/TLS.

Follow these steps to configure Windows Server 2012 LDAP for APIC access with Cisco AVPair:

Procedure

  1. Log in to an Active Directory (AD) server as a domain administrator.

  2. Add the CiscoAVPair attribute to the AD schema.

    1. Navigate to Start > Run, type MMC and press Enter.
      The Microsoft Management Console (MMC) opens.
    2. Navigate to File > Add/Remove Sanp-in > Add.
    3. In the Add Standalonee Snap-in dialog box, select the Active Directory Schema and click Add.
      The MMC Console opens.
    4. Right-click the Attributes folder, select the Create Attribute option.
      The Create New Attribute dialog box opens.
    5. Enter CiscoAVPair for the Common Name, CiscoAVPair for the LDAP Display Name, 1.3.6.1.4.1.9.22.1 for the Unique X500 Object ID, and select Case Sensitive String for the Syntax.
    6. Click OK to save the attribute.

  3. Update the User Properties class to include the CiscoAVPair attribute.

    1. In the MMC Console, expand the Classes folder, right-click the user class, and choose Properties.
      The user Properties dialog box opens.
    2. Click the Attributes tab, and click Add to open the Select Schema Object window.
    3. In the Select a schema object: list, choose CiscoAVPair, and click Apply.
    4. In the MMC Console, right-click the Active Directory Schema, and select Reload the Schema.

  4. Configure the CiscoAVPair attribute permissions.

    Now that the LDAP includes the CiscoAVPair attributes, LDAP users need to be granted Cisco APIC permission by assigning them Cisco APIC RBAC roles.

    1. In the ADSI Edit dialog box, locate a user who needs access to the Cisco APIC.
    2. Right-click on the user name, and choose Properties.
      The <user> Properties dialog box opens.
    3. Click the Attribute Editor tab, select the CiscoAVPair attribute, and enter the Value as shell:domains = <domain>/<role>/,<domain>//role.

      For example, if the CiscoAVPair has a value of shell:domains = solar/admin/,common//read-all(16001) , then solar is the security domain, admin is the role for this user that gives write privileges to this user in the security domain called solar , common is the Cisco Application Centric Infrastructure (Cisco ACI) tenant common, and read-all(16001) is the role with read privileges that gives this user read privileges to all of the Cisco ACI tenant common.

    4. Click OK to save the changes and close the <user> Properties dialog box.

The LDAP server is configured to access the Cisco APIC.

What to do next

Configure the Cisco APIC for LDAP access.