Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Change remote user role

Updated: April 17, 2026

Want to summarize with AI?

Log in

Describes the dynamic modification of user privileges that allows users to request role changes through external authentication servers.

Change remote user role is a dynamic user privilege modification feature that

  • allows users to request role changes that are allowed or denied based on information stored locally or remotely

  • is supported only through the Cisco ACS server and can be done by role assignment based on explicit request, and

  • assumes that the remote authentication server has components to support the role-change functionality.

Authentication protocols and rule matching

The ACI fabric supports external authentication using Radius, TACACS+ and LDAP protocols. The Cisco Secure ACS server provides the remote authentication, authorization and accounting features for the TACACS+ protocol.

Rules are matched, either with Default Device ADMIN or Default Network Access Service.

In the Authorization, another set of rules are configured:

  • AVPairOps: matches the TACACS+ username and AVPair value (cisco-av-pair*newrole). If the rule matches, the ACI_OPS shell-profile is returned

  • NoAVPair: matches only the TACACS+ username and return ACI_ADMIN shell profile on match

  • opsuser: matches only the protocol and returns ACI_OPS shell profile

Change the remote user role using the GUI

This task enables you to change a remote user's role in APIC through the GUI, allowing dynamic switching between different authorization levels based on configured Shell Profiles and AVPairs.

Remote user role changes are managed through ASC Authorization Policies that use TACACS+ AVPairs to authorize users with specific roles. The cisco-av-pair attribute controls the authorization level, with keywords like "readall" allowing elevation from default roles to higher privilege roles.

Before you begin

Roles must first be configured on the Cisco ASC Server to match the AVPairs and selected shell-authorization-profile based on the match.

Follow these steps to change the remote user role using the GUI:

Procedure

  1. Create an ASC Authorization Policy navigate to Access Policies > Access Services > Default Device Admin Identity and perform the following steps:

    Note

    Shell Profile is configured with CiscoAVPair , which is used to Authorize the User.

    1. Add the condition to TACACS+:AVPair equals cisco-av-pair* and click OK.
      Note

      The user is authorized with the cisco-av-pair role by default.

    2. Add the condition to TACACS+:AVPair equals cisco-av-pair*readall and click OK.
      Note

      The keyword readall is used in APIC to change the Role from default Role to readall Role (read-all is configured in Shell-Profile).

  2. Log in to the APIC GUI, click the welcome, <login_name> drop-down list and choose Change Remote User Role.

  3. In the Change Remote User Role dialog box, enter the information in the User Name, Password, and New Role fields and click Submit.

    The GUI will refresh with the new role applied.

    Note

    To return to the parent role, open the Change Remote User Role dialog box again and enter the information for User Name and Password but leave the New Role field blank.

The remote user role is successfully changed, and the GUI refreshes to reflect the new authorization level. The user can now access features and functions according to the newly assigned role privileges.

Change the remote user role using REST API

This task enables you to dynamically change user roles in the system using REST API calls, providing flexibility in managing user permissions during runtime operations.

Remote user role changes are necessary when users need to temporarily access different system functions or when role-based permissions need to be modified without requiring a new login session.

Before you begin

Roles must first be configured on the Cisco ASC Server to match the AVPairs and selected shell-authorization-profile based on the match.

The user logs in with the user-name apicadmin and password.

Follow these steps to change the remote user role using REST API:

Procedure

  1. Change to a new role:

    Example:

    <!--   api/requestNewRole/json   -->
<aaaChangeRole>
<attributes userName="apic#tacacs" apicadmin="pwd Ins3965!" role="newrole"/>

  2. Return to the original role:

    Example:

    <!--   api/requestNewRole/json   -->
<aaaChangeRole>
<attributes userName="apic#tacacs" apicadmin="pwd Ins3965!" role=""/>

The user role is successfully changed to the specified new role or returned to the original role based on the API call made.