Describes an authentication method that uses calculated signatures with private keys for secure APIC transactions.
A signature-based transaction is an authentication method that
-
calculates a signature for every transaction using a private key that must be kept secret in a secure location
-
enables the APIC to verify the signature using an X.509 certificate when receiving a request, and
-
provides the most secure authentication by requiring an attacker to crack the RSA/DSA key to forge or impersonate user credentials.
Authentication methods comparison
The APIC controllers in a Cisco ACI fabric offer different methods to authenticate users.
The primary authentication method uses a username and password and the APIC REST API returns an authentication token that can be used for future access to the APIC. This may be considered insecure in a situation where HTTPS is not available or enabled.
In signature-based authentication, every transaction to the APIC must have a newly calculated signature. This is not a task that a user should do manually for each transaction. Ideally this function should be utilized by a script or an application that communicates with the APIC.
Additionally, you must use HTTPS to prevent replay attacks.
Before you can use X.509 certificate-based signatures for authentication, verify that these pre-requisite tasks are completed:
-
Create an X.509 certificate and private key using OpenSSL or a similar tool.
-
Create a local user on the APIC. (If a local user is already available, this task is optional).
-
Add the X.509 certificate to the local user on the APIC.