Cisco APIC Security Configuration Guide, Release 6.2(x)

Local user configuration

Updated: April 17, 2026

Want to summarize with AI?

Describes how to configure local user accounts with granular, role-based access control for system management.

A local user is a system account that

provides authenticated access to the system with assigned roles and privileges
supports granular, role-based access control where accounts can be created with various roles including non-admin users with fewer privileges, and
exists in addition to the initial admin account that is configured in the initial configuration script when the system starts.

Local user access control

The APIC supports a granular, role-based access control system where user accounts can be created with various roles including non-admin users with fewer privileges.

Configure local user using the APIC GUI

This task creates a local user account in APIC with appropriate security domain access and role assignments to enable controlled access to ACI fabric resources.

Local user accounts provide authentication and authorization for APIC access when external authentication servers are not available or when specific users need fabric-local credentials. Users can be assigned to security domains with role-based privileges to control their access scope.

Before you begin

The ACI fabric is installed, APIC controllers are online, and the APIC cluster is formed and healthy.
As appropriate, the security domain(s) that the user will access are defined. For example, if the new user account will be restricted to accessing a tenant, the tenant domain is tagged accordingly.
A APIC user account is available that will enable the following:
- Creating the local user account in the target security domain(s). If the target domain is all, the login account used to create the new local user must be a fabric-wide administrator that has access to all. If the target domain is a tenant, the login account used to create the new local user must be a tenant administrator that has full read write access rights to the target tenant domain.

Follow these steps to configure a local user using the APIC GUI:

Procedure

On the menu bar, choose Admin > AAA.
In the Navigation pane, click Users.

In the Work pane, verify that you are in the Local tab.
In the Work pane, click Actions and select Create Local User.
In the Username field, add a username.
The login ID must meet these guidelines:
- Must be unique within APIC.
- Must begin with a letter.
- Can contain between 1 and 32 characters.
- Can include alphanumeric characters, underscores, dashes, and dots.
After creating a user account, you cannot change the username. You must delete the user account and create a new one.
In the Password field, enter the password. Enter the same password in the Confirm Password field.
(Optional) Enter a Description for the username.
You can activate or deactivate the user account by using the Account Status options. The options are—Active, Inactive, Blocked.
(Optional) Enter the First Name, Last Name, Email Address, Phone Number for the username.
To add a security domain, click Add Security Domain. Enter the details in the Add Security Domain window that is displayed.
1. Click Select Security Domain to select a security domain from the drop down list.
2. To associate a role to the username, click Select Role and select a role from the drop down list.
3. Select a Privilege Type from the drop down list, and click the tick-mark to associate the privilege to the selected role.
4. Click Add.
To enable the Expiration Set Status option, select the Enabled check-box.

If you select the check-box, a text box is displayed where in you need to enter a date and time, after which the username will be made inactive.
To enable the Password Update Required option, select the Enabled check-box.

If you select the check-box, after the first successful login of the user, the password will need to be updated.
To enable the OTP option, select the Enabled check-box.

If you select the check-box, the OTP key, and the QR code are generated for the user.

After user creation, click the User_name > Details icon to get the user details screen. Click the displayed OTP key to see the QR code.
Enter a user identity from the authentication certificate in the User Cert Attribute field. This is for certificate-based authentication.
For the X509 Certificate field, click Add X509 Certifcate to add a name and the certificate string.

For details about generating an X509 certificate, see the Generate an X.509 certificate and a private key procedure.
For the SSH Authorization field, click Add SSH Authorization to add a name and the authorization data.

To generate the SSH authorization data, run the UNIX command, SSH-keygen on your local machine.
Click Save.

The local user account is created and configured with the specified security domains, roles, and authentication options. The user can now log in to APIC with the assigned credentials and access resources within their authorized scope.

Configure SSH public key authentication using the GUI

SSH public key authentication provides a more secure method of logging in to a server compared to password-based authentication. This task enables you to set up SSH public key authentication for local users through the GUI interface.

SSH public key authentication uses a pair of keys (public and private) to authenticate users. The public key is stored on the server, while the private key remains with the user. This method enhances security by eliminating the need to transmit passwords over the network.

Before you begin

Create a local user account in the target security domain(s). If the target domain is all, the login account used to create the new local user must be a fabric-wide administrator that has access to all. If the target domain is a tenant, the login account used to create the new local user must be a tenant administrator that has full read write access rights to the target tenant domain.
Generate a public key using the Unix command SSH-keygen .

The default login domain must be set to local

Follow these steps to configure SSH public key authentication using the GUI:

Procedure

On the menu bar, choose Admin > Users and confirm you are in the Local tab.
In the Work pane, click the name of the user that you previously created.

A window is displayed on the right with information about the user.
Click the Details icon, , and the user details are displayed on a new screen.

Scroll down to see the SSH Authorization details.
Click the Edit icon, , and the Edit Local User screen is displayed. You can change the SSH details as required.

Note

To create the SSH Private Key File for downloading to a remote location, in the menu bar, expand Firmware > Download Tasks.
Click Save.

SSH public key authentication is now configured for the selected local user. The user can authenticate using their private key instead of a password when connecting to the system.

Configuring the SSH host key sizes using the GUI

In addition to the defaut values, you can configure multiple algorithms and hostkey sizes based on your scenario.

Follow these steps to configure the SSH host key sizes.

Procedure

Navigate to Fabric > Fabric Policies > Policies > Pod > Management Access > policy_name.
Select Policy > Console Access.

For Hostkey Sizes add or remove your desired algorithm sizes.

When a Hostkey Size is selected, it takes precedence over the host key algorithms selection. APIC automatically determines the enabled host key algorithms from the selected key sizes. If the two selections do not match, APIC automatically adjusts the algorithm list to match the selected key sizes.

For example, if RSA algorithms are selected under Hostkey Algorithms, but ED25519+ECDSA are selected under the Host Key sizes, APIC disables the selected RSA algorithms and enables the ED25519 and ECDSA instead.

Table 1. Hostkey sizes and algorithms
Hostkey algorithms	Hostkey sizes
ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521	ecdsa-256 ecdsa-384 ecdsa-521
rsa-sha2-256 rsa-sha2-512	rsa-2048 rsa-3072 rsa-4096
ssh-ed25519	ed25519

Configure a local user using the REST API

This task creates a local user account on the APIC controller, allowing administrators to establish user access with specific domain and role permissions through REST API operations.

Local user accounts provide authentication and authorization for accessing APIC functionality. This procedure uses the REST API to programmatically create user accounts with designated privileges.

Procedure

Create a local user.

Example:

URL: https://apic-ip-address/api/node/mo/uni/userext.xml
POST CONTENT:
    <aaaUser name="operations" phone="" pwd="<strong_password>" >
        <aaaUserDomain childAction="" descr="" name="all" rn="userdomain-all" status="">
        <aaaUserRole childAction="" descr="" name="Ops" privType="writePriv"/>
        </aaaUserDomain>
    </aaaUser>

The local user account is created with the specified username, password, domain assignment, and role privileges. The user can now authenticate to the APIC controller with the configured permissions.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.