Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Login domains

Updated: April 17, 2026

Want to summarize with AI?

Log in

Describes the authentication domain mechanism that enables users to select the correct authentication method when accessing the system.

A login domain is an authentication domain mechanism that

  • defines the authentication domain for a user

  • can be set to Local, LDAP, RADIUS, TACACS+, DUO, SAML, RSA, or OAuth 2 authentication mechanisms, and

  • enables the user to select the correct authentication domain when accessing the system from REST, CLI, or GUI.

Authentication access methods

When accessing the APIC through different interfaces, the authentication method varies:

  • REST: The username is prefixed with a string so that the full login username looks as follows:

    apic:<domain>\<username>

  • GUI: The APIC offers a drop-down list of domains for the user to select.

If no apic: domain is specified, the default authentication domain servers are used to look up the username.

Starting in ACI version 1.0(2x), the login domain fallback of the APIC defaults local. If the default authentication is set to a non-local method and the console authentication method is also set to a non-local method and both non-local methods do not automatically fall back to local authentication, the APIC can still be accessed via local authentication.

To access the APIC fallback local authentication, use these strings:

  • Use the APIC#fallback\\username string for REST API, GUI, and CLI for both APIC and Switches.

  • Use the apic:fallback\\username string for only the REST API and the GUI, but not for the CLI interface.

Note

Do not change the fallback login domain. Doing so could result in being locked out of the system.

Create login domain using the GUI

This task creates a login domain to define authentication parameters for users accessing the fabric through external authentication servers. The login domain establishes the realm and authentication method for user access control.

Authentication by an external server for SAML and OAuth 2 is based on user group map rule information, in addition to the standard CiscoAVpair-based authentication.

Before you begin

  • The Cisco Application Centric Infrastructure (ACI) fabric is installed, Application Policy Infrastructure Controllers (APICs) are online, and the APIC cluster is formed and healthy.

  • The login domain name, realm, and remote server provider are available to define the authentication domain for the user.

Follow these steps to create a login domain using the GUI:

Procedure

  1. On the menu bar, choose Admin > AAA.

  2. In the Navigation pane, choose Authentication.

  3. In the Work pane, choose the Login Domains tab.

  4. Click the Actions button > Create Login Domain.

  5. In the Create Login Domain screen, in the General pane, specify the following:

    • The user configured domain name.

    • Description of the login domain.

    • The realm to verify the identity of an entity (person or device) accessing the fabric devices. The options available in the Realm drop-down list are discussed here:

      1. A RADIUS provider group for a group of remote servers supporting the RADIUS protocol for authentication.

      2. A TACACS+ provider group for a group of remote servers supporting the TACACS+ protocol for authentication.

      3. An LDAP provider group for a group of remote servers supporting the LDAP protocol for authentication.

      4. A RSA provider group for a group of remote servers supporting the RSA protocol for authentication.

      5. A SAML provider remote server supporting the SAML protocol for authentication.

      6. An OAuth 2 provider remote server supporting the OAuth 2 protocol for authentication.

    Note

    If LDAP, RADIUS, or TACACS+ is specified as the default security method and the associated provider group specified in this dialog is not available to provide authentication during a user login, fallback local authentication is not executed by the Cisco APIC server unless is specifically configured to do so.

    If Cisco APIC requires proxy servers to reach identity providers, then configure the corresponding proxy addresses. The proxy setting configuration is found under System > System Settings > Proxy Policy. In the Proxy Policy pane, enter the required URL in the HTTP URL or HTTPS URL fields.

  6. Fill in the details for the displayed options. The displayed options are dynamic and based on the selected Realm.

    When the selected Realm is RADIUS or LDAP, these options are displayed:

    • Select either Default or Duo for the Realm Subtype.

    • In the Settings pane, click Add RADIUS (or LDAP) Provider to select or create a provider if you selected the Default option above. If you have selected the Duo option, click Add RADIUS (or LDAP) Duo Provider to select or create a provider.

    When the selected Realm is TACACS+ or RSA, these options are displayed:

    • In the Settings pane, click Add RSA (or TACACS+) Provider to select or create a provider.

    When the selected Realm is SAML or OAuth 2, these options are displayed:

    • In the Settings pane, click Select SAML (or OAuth 2) Provider to select or create a provider.

    • For SAML (or OAuth 2) Authorization Choice, select either CiscoAVPair or GroupMap.

      • When CiscoAVPair is selected, the authorization is based on the CiscoAVpair value/ string configured on the external authentication server. On receiving the CiscoAVPair value from external IDP, Cisco APIC assigns the privileges accordingly to the remote user.

      • When GroupMap is selected, the authorization is based on the group information configured on the external authentication server. On receiving the user group information from the external IDP, Cisco APIC matches the user group name configured on Cisco APIC and assigns the privileges to the remote user accordingly.

      Two additional parameters are required for authorization using GroupMap, they are:

      • Enter the Group Attribute. The group attribute entered here should match the group attribute on the external authentication server. For SAML, the group attribute should match the name of the group assertion in the response sent by the SAML IDP server. For OAuth2, the group attribute should match the group claim in the JWT (JSON Web Token) sent by the OAuth2 server.

        Example: memberOf (used in Active directory), Groups or groups (used in ping ID/Okta)

        Also, for OAuth2, to receive group information from IDP properly, ensure corresponding scope is configured in the OAuth2 provider configuration. Example: openid profile groups .

      • Add a User Group Map Rule, by clicking Add User Group Map Rule.

        In the Add User Group Map Rule window, enter these details:

        1. In the Name field, enter a name for the user group map rule.

        2. In the Description field, enter a description.

        3. In the User Group field, enter the name of the user group to which the user belongs.

          Ensure that the user group entered here matches the user group on the external server. This is used by Cisco APIC to validate the authentication information received from the external server. Privileges are set based on the user group to which the user belongs.

        4. To set User Privileges, click Add User Privileges.

        5. To add a security domain, click Select Security Domain to choose a security domain from the displayed list.

        6. Click Add Role to select a role and associate a privilege type (read or write); click the tick mark to associate the privilege to the role.

          To add more roles, click Add Role, and associate privileges.

        7. Click Add (on Add User Privileges window).

        8. Click Apply (on the Add User Group Map Rule window).

  7. Click Save (on the Create Login Domain screen).

The login domain is created with the specified authentication parameters. Users can now authenticate using the configured external authentication server through this login domain.