Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Create a provider

Updated: April 17, 2026

Want to summarize with AI?

Log in

Create an external authentication provider for Cisco APIC.

Use this procedure to create a provider for the authentication/authorization protocols.

Before you begin

The relevant prerequisites before creating a provider for an authentication/authorization protocol is discussed under the relevant protocol sections.

Procedure

  1. On the menu bar, choose Admin > AAA .

  2. In the Navigation pane, choose Authentication .

  3. In the Work pane, choose Providers .

  4. Click Actions > Create Provider .

  5. In the Create Provider screen that is displayed, enter the Hostname/IP Address , Description , and choose a Realm from the drop-down list. The choices available for Realm are:

    • RADIUS

    • TACACS+

    • LDAP

    • SAML

    • RSA

    • OAuth 2

    The options for configuring a provider are dynamic and change as per the selected Realm . The options available for each Realm are discussed in detail, in the subsequent steps.

  6. Applicable only for RADIUS: Choose a Realm Subtype . The options are Default or Duo . Specify the following:

    • Password for the RADIUS server; enter the password again for confirmation.

    • Click Select Reachability EPG to choose an endpoint group.

    • The service port number for RADIUS. The range is 1 to 65535. The default value is 1812.

    • The authentication protocol, options are PAP , CHAP , MS-CHAP . You will see this option only if you chose Default for the Realm Subtype .

    • The timeout for communication with a RADIUS server. The range is from 0 to 60 seconds. The default is 5 seconds (Realm Subtype: Default); default is 30 seconds (Realm Subtype:Duo).

    • The number of retries when contacting the RADIUS endpoint.

    • Select the Enabled check box to enable periodic server monitoring; enter a user name and password for the same.

    This step is for RADIUS provider configuration. You can now proceed to step 12.

  7. (Optional step; applicable only for TACACS+) Specify the following:

    • Password for the TACACS+ server; enter the password again for confirmation.

    • From the Select Reachability EPG drop-down list, choose an endpoint group.

    • Enter the service port number for TACACS+ in the Port field.

      The range is 1 to 65535. The default value is 49 for TACACS+ over non-TLS.

    • The authentication protocol, options are—PAP, CHAP, MS-CHAP.

    • The timeout for communication with a TACACS+ server. The range is from 0 to 60 seconds. The default is 5 seconds.

    • The number of retries when contacting the TACACS+ endpoint.

    • Select the Enabled check box to enable periodic server monitoring; enter a user name and password for the same.

      Follow these steps to configure TACACS+ over TLS.

    • Check the Enable TACACS+ over TLS check box to enable TACACS+ over TLS connection.

      When TACACS+ over TLS is enabled, the TACACS+ provider must not be configured with Shared Secret .

    • In SSL Certificate Validation Level , choose Strict or Permissive option.

    • From the Key Ring drop-down list, choose the key ring certificate for the TACACS+ provider.

    • From the Certificate Authority drop-down list, choose the CA certificate for the TACACS+ provider.

    • Enter the service port number for TACACS+ in the Port field.

      The range is 1 to 65535. The default value is 6049 for TACACS+ over TLS.

    Note

    The user having AAA privilege can modify TLS mode to non-TLS mode and conversely in TACACS+ provider configuration.

    This step is for TACACS+ provider configuration. You can now proceed to step 12.

  8. (Optional step; applicable only for LDAP) Choose a Realm Subtype, options are— Default or Duo . Specify the following:

    • The Root Distinguished Name (DN) of the LDAP directory.

    • The LDAP Base DN, which is the container name and path in the LDAP server where the APIC searches for the remote user account. This is where the password is validated. Filter is used to locate the attribute that the APIC requests to use for the Cisco AVPair .

    • Password for the LDAP server; enter the password again for confirmation.

    • The service port number for LDAP. The range is 1 to 65535. The default value is 389.

    • Click Select Reachability EPG to choose an endpoint group.

    • The timeout for communication with an LDAP server. The range is from 0 to 60 seconds. The default is 30 seconds.

    • The number of retries when contacting the LDAP endpoint.

    • Select the Enable check box to enable SSL.

    • SSL Certificate Validation Level. The options are:

      • Permissive—A debugging knob to help diagnose DUO LDAP SSL Certificate issues.

      • Strict—A level that should be used when in production.

    • LDAP Attribute.

    • Authentication Method. The options are:

      • LDAP Bind

      • Password Compare

    • Filter Type. Filters are a key element in defining the criteria used to identify entries in search requests. Example: (cn=*), which means any entry that contains one or more cn values. The options are:

      • Default

      • Microsoft Active Directory

      • Custom

    • LDAP Filter. This field is auto-filled based on the selected Filter Type (unless you have chosen the Custom option Filter Type). If you have chosen Default, the filter is cn=Suserid ; if you have chosen Microsoft Active Directory, the filter is sAMAccountName=Suserid .

    • Select the Enabled check box to enable periodic server monitoring; enter a user name and password for the same.

    This step is for LDAP provider configuration. You can now proceed to step 12.

  9. (Optional step; applicable only for RSA) Specify the following:

    • Password for the RSA server; enter the password again for confirmation.

    • Click Select Reachability EPG to choose an endpoint group.

    • The service port number for RSA. The range is 1 to 65535. The default value is 1812.

    • The timeout for communication with a RSA server. The range is from 0 to 60 seconds. The default is 5 seconds.

    • The number of retries when contacting the RSA endpoint.

    • Select the Enabled check box to enable periodic server monitoring; enter a user name and password for the same.

    This step is for RSA provider configuration. You can now proceed to step 12.

  10. (Optional step; applicable only for SAML) Specify the following:

    • Identity Provider (IdP). The options are—ADFS, OKTA, PING IDENTITY.

    • Metadata URL provided by IDP.

      In case of ADFS, Metadata URL provided by IDP is of the format, https://<FQDN of ADFS>/FederationMetadata/2007-06/FederationMetadata.xml.

      For Ping ID, copy the metadata URL link from the configuration section of the Ping ID server (under the SAML application).

    • Enter the IdP Entity ID for the SAML-based service.

    • Enter the SP Entity ID (Service Provider Entity ID). This identifier represents the APIC and can be any string, although the ACS URL is commonly used. Configure the same value on the Identity Provider (IdP).

      For the 6.2(2) release and earlier, use the query-parameter URL: 
      https://apic-id/api/aaaLoginSSO.json?name=domain-name
      For the 6.2(3) release and later, use the path-based URL: 
      https://apic-saml/<samldomain-name>

      The SP Entity ID is a required field and cannot be empty during SAML provider creation on APIC. It is an arbitrary but stable identifier for APIC as the SAML service provider. For example, you can use https://apic-saml/OKTA; it does not have to be a reachable URL and is not the ACS URL. Use the same SP Entity ID on every APIC a given cluster, and configure this same value as the SP Entity ID / Audience (relying-party identifier) on the identity provider.

    • Click Select Certificate Authority to select a certificate authority if IdP is signed by a private CA.

    • GUI Redirect Banner. This can be a URL or a message. This information is displayed before the user is redirected to the Identity Provider login page for authentication.

    • The timeout for communication with a SAML server. The range is from 0 to 60 seconds. The default is 5 seconds.

    • Select the Signature Algorithm from the drop down list.

    • Put a check in the Enabled check box, to enable all/any of these— Encrypted SAML Assertions, Assertions in SAML Response Signed, SAML Auth Requests Signed, SAML Response Message Signed.

    This step is for SAML provider configuration. You can now proceed to step 12.

  11. (Optional step; applicable only for OAuth 2) Specify the following:

    • Client ID—Client identifier of the APIC application on IdP.

    • Client Secret for the APIC application. Enter the client secret again for confirmation.

    • Username Claim. Username attribute in the token. Example: email, sub.

    • Scope. List of OAuth 2 scopes. Example: "openid profile". To receive user group information, add the corresponding scope configured in the IdP provider. Example: "openid profile groups".

    • Choose to Enable or Disable the OIDC Protocol.

    • Put a check in the Enabled check box to Verify Token Signature.

    • JWKS Endpoint. The JSON Web Key Sets (JWKS) to verify the token. This field is displayed only if you have enabled Verify Token Signature.

    • Authorization Endpoint. The IdP endpoint authorization URL. Get the authorization endpoint from the IdP server. This field is displayed only when the OIDC protocol is disabled.

    • Token Endpoint. The IdP endpoint token URL. Get the token endpoint from the IdP server. This field is displayed only when the OIDC protocol is disabled.

    • Issuer URL. Get the issuer URL from the IdP server. This field is displayed only when the OIDC protocol is enabled.

    • Click Select Certificate Authority to select a certificate authority if IdP is signed by a private CA.

    • Click Select Reachability EPG to choose an endpoint group.

    • The timeout for communication with an OAuth 2 server. The range is from 0 to 60 seconds. The default is 5 seconds.

    • GUI Redirect Banner. This can be a URL or a message. This information is displayed before the user is redirected to the Identity Provider login page for authentication.

    This step is for OAuth 2 provider configuration. You can now proceed to step 12.

  12. Click Save .