Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

AV pairs on external authentication servers

Updated: April 17, 2026

Want to summarize with AI?

Log in

Explains the Cisco AV pair configuration on external authentication servers that specifies required RBAC roles and privileges for users.

An AV pair on an external authentication server is a configuration mechanism that

  • specifies the APIC required RBAC roles and privileges for the user

  • uses the same format for RADIUS, LDAP, or TACACS+, and

  • is configured by adding a Cisco AV pair to the existing user record on the external authentication server.

AV pair configuration details

The Cisco APIC requires that an administrator configure a Cisco AV Pair on an external authentication server. To configure a Cisco AV Pair on an external authentication server, an administrator adds a Cisco AV pair to the existing user record.

The Cisco AV pair format is as follows:

shell:domains = 
domainA/writeRole1|writeRole2|writeRole3/readRole1|readRole2,
domainB/writeRole1|writeRole2|writeRole3/readRole1|readRole2
shell:domains = 
domainA/writeRole1|writeRole2|writeRole3/readRole1|readRole2,
domainB/writeRole1|writeRole2|writeRole3/readRole1|readRole2(16003)

Starting with Cisco APIC release 2.1, if no UNIX ID is provided in AV Pair, the APIC allocates the unique UNIX user ID internally.

Starting with release 3.1(x), the AV Pair shell:domains=all//admin allows you to assign Read-only privileges to users and provide them access to the switches and run commands.

The APIC supports these regexes:

shell:domains\\s*[=:]\\s*((\\S+?/\\S*?/\\S*?)(,\\S+?/\\S*?/\\S*?){0,31})(\\(\\d+\\))$
shell:domains\\s*[=:]\\s*((\\S+?/\\S*?/\\S*?)(,\\S+?/\\S*?/\\S*?){0,31})$
Note

The APIC Cisco AV-pair format is compatible and can co-exist with other Cisco AV-pair formats. APIC will pick up the first matching AV-pair from all the AV-pairs.

Note

The "/" character is a separator between writeRoles and readRoles per Security domain and is required even if only one type of role is to be used.

The Cisco AVpair string is case sensitive. Although a fault may not be seen, using mismatching cases for the domain name or roles could lead to unexpected privileges being given.

AV pair configuration examples

These examples show different AV pair configurations:

  • Example 1: A Cisco AV Pair that contains a single Security domain with only writeRoles:

    shell:domains=domainA/writeRole1|writeRole2/

  • Example 2: A Cisco AV Pair that contains a single Security domain with only readRoles:

    shell:domains=domainA//readRole1|readRole2
An example configuration for an open RADIUS server (/etc/raddb/users) is as follows: 
aaa-network-admin Cleartext-Password := "<password>"
Cisco-avpair = "shell:domains = all/aaa/read-all(16001)"

Best practice for assigning AV pairs

As best practice, we recommend that you assign unique UNIX user IDs in the range of 16000 to 23999 for the AV pairs that are assigned to users when in the Bash shell (using SSH, Telnet, or serial/KVM consoles). If a situation arises when the Cisco AV pair does not provide a UNIX user ID, the user is assigned a user ID of 23999 or similar number from the range that also enables the user's home directories, files, and processes accessible to remote users with a UNIX ID of 23999.

Note

Beginning with the 5.3(1) release, telnet is not supported.

To ensure that your remote authentication server does not explicitly assign a UNIX ID in its cisco-AV-pair response, open an SSH session to the Cisco Application Policy Infrastructure Controller (APIC) and log in as an administrator using a remote user account. After you have logged in, run these commands (replace "userid" with the username with which you logged in):


admin@apic1:remoteuser-userid> cd /mit/uni/userext/remoteuser-userid
admin@apic1:remoteuser-userid> cat summary

The Cisco AV pair string is case sensitive. Although a fault may not be seen, using mismatching cases for the domain name or roles could lead to unexpected privileges being given.

Configure an AV pair on the external authentication server

Configure an AV pair on the external authentication server to define user authentication parameters and domain access privileges for SSH or telnet login sessions.

The numerical value within the parentheses in the attribute/value (AV) pair string is used as the UNIX user ID of the user who is logged in using Secure Shell (SSH) or telnet.

Note

Beginning with the 6.0(2) release, telnet is not supported.

Procedure

Configure an AV pair on the external authentication server.

The Cisco AV pair definition is as follows (Cisco supports AV pairs with and without UNIX user IDs specified):

Example:

shell:domains = domainA/writeRole1|writeRole2|writeRole3/readRole1|readRole2,domainB/writeRole1|writeRole2|writeRole3/readRole1|readRole2
shell:domains = domainA/writeRole1|writeRole2|writeRole3/readRole1|readRole2,domainB/writeRole1|writeRole2|writeRole3/readRole1|readRole2(8101)

These are the boost regexes supported by APIC:
uid_regex("shell:domains\\s*[=:]\\s*((\\S+?/\\S*?/\\S*?)(,\\S+?/\\S*?/\\S*?){0,31})(\\(\\d+\\))$");
regex("shell:domains\\s*[=:]\\s*((\\S+?/\\S*?/\\S*?)(,\\S+?/\\S*?/\\S*?){0,31})$");

The following is an example:

shell:domains = coke/tenant-admin/read-all,pepsi//read-all(16001)
Note

ACI users have limited access to APIC nodes. After you login to APIC using the CLI, you stay in a restricted sandbox with limited privileges. As an ACI user, you get your own home directory /home/$user and a /tmp directory. The mounted /tmp directory for a user is different from /tmp directory of the main system. You can create files only under these directories, you cannot create and delete files in any other directory. Also, you cannot delete files created by other users. Users also have restrictions regarding CPU, memory usages and FDs. Read-only users cannot create, update, or delete any configuration data.

The AV pair is configured on the external authentication server with the specified domain access and user privileges.