Configuration Guide for Cisco Optical Site Manager, IOS XR Release 26.x.x
Configuration Guide for Cisco Optical Site Manager, IOS XR Release 26.x.x
This section provides details about managing external authentication in Cisco Optical Site Manager. Use it to review supported values, fields, options, and operational details.
This reference provides information about manage external authentication.
This chapter describes the tasks related to external authentication in Cisco Optical Site Manager.
Cisco Optical Site Manager supports RADIUS and TACACS modes of external authentication. Ensure that you enable and use either RADIUS or TACACS authentication method. You can add a maximum of up to ten servers for each of RADIUS or TACACS on Cisco Optical Site Manager.
There should be at least one RADIUS or TACACS authentication server that is configured for authentication to be enabled. In order to delete the last RADIUS or TACACS server, you must disable the external authentication first, and then delete the RADIUS or TACACS server.
When your login to Cisco Optical Site Manager with the external authentication enabled, Cisco Optical Site Manager first tries with the configured list of servers. If external authentication servers are not reachable, then Cisco Optical Site Manager uses local authentication provided the local authentication is enabled on Cisco Optical Site Manager.
To manage Cisco Optical Site Manager, the following users are created:
Local users (local authentication)-Specifies users who are created to manage Cisco Optical Site Manager instances.
External users (external authentication)-Specifies users who are created on the external authentication servers.
For more information related to users, see External Authentication Users for SVO.
The following table lists some external authentication scenarios that describe some possible authentication errors, causes, and actions.
A proper privilege level must be set on the external authentication server associated to the user. See the Privilege level and user group mapping table.
If a privilege level is not set for a user in the external authentication server, the user is allowed to log in only as Viewer. In this case, LOGIN-MISSING-GROUP alarm is raised.
|
External and Local Authentication Combination |
Possible Authentication Scenario |
Possible Cause |
Action to be Taken |
|---|---|---|---|
|
Server denies authentication |
External username or password is incorrect |
Enter the correct username and password to log in to the system. |
|
Server not reachable |
IP address, shared secret or port number is not configured correctly although username or password could be correct |
You are locked out of the system. Ensure that you have configured correct IP address, shared secret, and port number. |
|
|
User authenticated with lowest privilege (Viewer) despite the intended one |
Privilege level is not set or incorrectly set on the external authentication server |
Set the proper privilege level associated to the user on the external authentication server |
|
|
Server denies authentication (although local authentication is enabled) |
External username or password is incorrect |
Enter the correct username and password to log in to the system. Local authentication only works when the RADIUS or TACACS external servers are not reacheable. |
|
Server not reachable (Local authentication is enabled) |
IP address, shared secret, port number is not configured correctly although username or password could be correct |
Use local authentication credentials to log in to Cisco Optical Site Manager. |
|
|
User authenticated with lowest privilege (Viewer) despite the intended one |
Privilege level is not set or incorrectly set on the external authentication server |
Set the proper privilege level associated to the user on the external authentication server |
Use this task to configure loopback interface as source.
If the Cisco Optical Site Manager management interface is configured as a loopback interface, Cisco Optical Site Manager uses it as the default source. If your network has filtering rules that restrict access to certain servers like RADIUS or TACACS+, you can configure a specific interface IP address to be used as the source address for this traffic.
This example shows how to configure a specific interface as source:
RP/0/RP0/CPU0:WHIT-OLT-1#conf t
RP/0/RP0/CPU0:WHIT-OLT-1(config)#linux networking
RP/0/RP0/CPU0:WHIT-OLT-1(config-lnx-net)#vrf default
RP/0/RP0/CPU0:WHIT-OLT-1(config-lnx-vrf)#address-family ipv4
RP/0/RP0/CPU0:WHIT-OLT-1(config-lnx-af)#source-hint default-route interface MgmtEth0/RP0/CPU0/0
Log into Cisco Optical Site Manager
Follow these steps to configure loopback interface as source.
The configure loopback interface as source task is complete.
External user list is maintained with username and its respective group (admin, editor, viewer, or maintenance). The user list is populated whenever a new username is successfully authenticated. This user list is limited to 500 users. The Clear External Users List button available under the External Authentication tab is activated when 450 users limit is reached. Whenever you click the Clear External Users List button, the external users are cleared. In the user list, if the user limit is reached (500 users), then the new external user (501th external user) cannot login to Cisco Optical Site Manager.
If you are logged in as external user and cleared the list, ensure that you must relogin on all the logged-in sessions. If you do not relogin, the system might not respond properly and information might not appear properly.
User role mapping for TACACS+ and RADIUS authentication assigns specific user roles after the authentication and authorization succeeded flows. These roles determine the level of access and permissions granted to the user on the network device or management system for their session.
User roles are assigned based on attributes returned by the authentication server.
These roles determine the access level and permissions a user has on network devices or management systems.
Cisco Optical Site Manager interprets these privilege level values received from authorization responses and assigns the corresponding internal role:
|
Privilege Level |
User Group |
|---|---|
|
0 |
viewer |
|
1 |
editor |
|
2 |
maintenance |
|
3 |
admin |
|
7 |
maintenance |
|
15 |
admin |
Viewer and maintenance users can view all paths except
/adminand/auth, and can edit only their own profile information. Editor user can view and edit all paths except/adminand/auth. Admin user has full access to view and edit everything.
Use the following tasks to manage RADIUS authentication on Cisco Optical Site Manager.
Only an admin can manage RADIUS authentication on Cisco Optical Site Manager.
Use this task to create RADIUS server entry.
Use this task to create RADIUS server entry on Cisco Optical Site Manager. Only an admin can add RADIUS server.
Ensure that you have added Cisco Optical Site Manager instances with RADIUS IP addresses in the Cisco Identity Services Engine (ISE).
Configure or assign the privilege level settings based on RADIUS user or group in the Cisco Secure ISE server. This will allow RADIUS users to log in to and access COSM.
Follow these steps to create RADIUS server entry.
The create RADIUS server entry task is complete.
Use this task to enable RADIUS authentication.
Use this task to enable RADIUS authentication. Only an admin can enable RADIUS authentication. You can add upto ten RADIUS servers on Cisco Optical Site Manager.
Follow these steps to enable RADIUS authentication.
Click Users & Access in the left panel.
Click the External Authentication tab.
In the RADIUS Configuration area, perform the following steps:
Click Apply.
The enable RADIUS authentication task is complete.
Use this task to modify RADIUS server parameters.
Use this task to modify RADIUS authentication settings. Only an admin can modify RADIUS server settings.
Log into Cisco Optical Site Manager and Create RADIUS server entry
Follow these steps to modify RADIUS server parameters.
The modify RADIUS server parameters task is complete.
Use this task to disable the RADIUS authentication.
Use this task to disable RADIUS authentication.
Log into Cisco Optical Site Manager
Follow these steps to disable the RADIUS authentication.
The disable the RADIUS authentication task is complete.
Use this task to delete the RADIUS server from Cisco Optical Site Manager.
Use this task to delete the RADIUS server entry from Cisco Optical Site Manager.
Log into Cisco Optical Site Manager
Follow these steps to delete the RADIUS server from Cisco Optical Site Manager.
Click Users & Access in the left panel.
Click the External Authentication tab.
In the RADIUS Configuration area, select the RADIUS server to delete and click the - button.
The delete the RADIUS server from Cisco Optical Site Manager task is complete.
Use the following tasks to manage TACACS+ authentication.
Only users with admin privileges can manage TACACS+ authentication on Cisco Optical Site Manager.
Use this task to create tacacs+ server entry on Cisco Optical Site Manager.
Use this task to create TACACS+ server entry on Cisco Optical Site Manager. Only an admin can add TACACS+ server. You can add upto ten TACACS+ servers.
Ensure that you have added Cisco Optical Site Manager instances with TACACS+ IP addresses in the Cisco Identity Services Engine (ISE).
Configure or assign the privilege level settings based on TACACS+ user or group in the Cisco Secure ISE server. This will allow TACACS+ users to log in to and access COSM.
Follow these steps to create tacacs+ server entry on Cisco Optical Site Manager.
The create tacacs+ server entry on Cisco Optical Site Manager task is complete.
Use this task to enable tacacs+ authentication.
Use this task to enable TACACS+ authentication.
Follow these steps to enable tacacs+ authentication.
The enable tacacs+ authentication task is complete.
Use this task to modify tacacs+ server parameters.
Use this task to modify TACACS+ authentication settings. Only an admin can modify TACACS+ server settings.
Log into Cisco Optical Site Manager and Create tacacs+ server entry on Cisco Optical Site Manager
Follow these steps to modify tacacs+ server parameters.
Click Users & Access in the left panel.
Click the External Authentication tab.
In the TACACS+ Configuration area, select the TACACS+ server to edit from the list of available TACACS+ servers and perform the following tasks:
The modify tacacs+ server parameters task is complete.
Use this task to disable the tacacs+ authentication.
Use this task to disable TACACS+ authentication.
Log into Cisco Optical Site Manager
Follow these steps to disable the tacacs+ authentication.
The disable the tacacs+ authentication task is complete.
Use this task to delete the tacacs+ server from Cisco Optical Site Manager.
Use this task to delete the TACACS+ server entry from Cisco Optical Site Manager.
Disable the tacacs+ authentication
Follow these steps to delete the tacacs+ server from Cisco Optical Site Manager.
Click Users & Access in the left panel.
Click the External Authentication tab.
In the TACACS+ Configuration area, select the TACACS+ server to delete and click the - .
The delete the tacacs+ server from Cisco Optical Site Manager task is complete.