Support for Remote Authentication

With Remote Authentication, it is easier to integrate IoT FND into an existing AD and Network Policy Server (NPS) infrastructure. This allows administrators to configure IoT FND access for users in AD.

When you configure remote authentication in IoT FND, it hands over the authentication and authorization responsibility to AD and NPS. AD performs user authentication to check the validity of user credentials. The RADIUS server performs user authorization to check whether a user belongs to a group that defines the user role. If so, the server returns the role name to IoT FND.

The following is the flow of user authentication and authorization by AD and NPS:

1. The user enters their credentials.

2. For remote users, if authentication and authorization are successful, the assigned user role returns to the NMS server from the RADIUS server.

3. If the role that returns is valid, the user is granted access.

Note: When remote authentication is enabled, user management is done in AD. If an AD user logs in who was deleted from IoT FND, their profile is added back to IoT FND. To prevent access to IoT FND, their AD user profiles must first be deleted from AD.

Configuring Remote Authentication in AD

To allow IoT FND to remotely authenticate users, configure the following within Active Directory

1. Log in to NPS.

2. Add IoT FND as a radius client on the RADIUS server.

Provide a friendly name, and IP address or DNS name of the IoT FND server and configure the shared secret that IoT FND uses to connect to the RADIUS server.

An entry for the RADIUS client appears under RADIUS Clients and Servers.

3. Log in to AD and create an Organizational Unit.

Cisco recommends that you create all security groups (IoT FND roles) within this Organizational Unit.

4. Add security groups corresponding to IoT FND roles to the Organizational Unit.

The following example shows the security groups defined in the NMS_ROLES Organizational Unit.

Tip: When creating the security groups, ensure that they map one-to-one to IoT FND roles (that is, every role defined in IoT FND maps to only one AD security group). The name of the security group does not have to match a role name in IoT FND, but for organizational purposes, Cisco recommends using names that correlate the security group name to a IoT FND role.

Note: You cannot create or assign the IoT FND root role in AD.

5. Assign AD users a role by adding them to the security group mapping to that role.

Since, users can only belong to one security group, the IoT FND role that the user is assigned after log in is dependent on their assigned AD security group.

Tip: In AD, users cannot be assigned multiple IoT FND roles, and cannot belong to multiple security groups. To assign permissions from more than one role to a group of users, create a new IoT FND role with the required permissions, and a create the corresponding AD security group. Users in this new group can then carry out the tasks allowed by this role.

6. Configure the Dial-in Network Access Permission to use the NPS Network Policy.

Configuring Security Policies on the RADIUS Server

To authorize users for IoT FND access, configure security policies for the RADIUS server.

To configure security policies on the RADIUS server, follow these steps:

1. Create a network policy for each security group you created in AD.

2. Configure the policy as follows:

a. In the Overview pane, define the policy name, enable it, and grant access permissions.

b. Click the Conditions tab, select the User Groups condition, and click Add.

The User Groups condition specifies that the connecting user must belong to the selected group. For this policy to pass, the user being authorized must belong to the user group configured in this policy.

c. In the User Groups window, click Add Groups.

d. In the Select Group window, enter the name of the group

e. Click OK to close the Select Group dialog box, and then click OK to close the User dialog box.

f. Click Cancel to close the Select condition window.

The condition appears in the Conditions pane.

g. Click the Settings tab, and then click Add to display the Attribute Information window.

h. Click Add to define a Vendor Specific Attribute (VSA) that is sent to IoT FND (RADIUS client) after the user credentials and security group membership are verified.

The VSA to configure is:

Note: The string entered in the Attribute value field must be the exact string listed in the Radius Server VSA column on the Roles page in IoT FND (ADMIN > Access Management > Roles).

i. Click OK.

The VSA attribute appears in the Settings pane.

j. Click OK.

Configuring Remote Authentication in IoT FND

You enable remote user authentication and configure RADIUS server settings on the Remote Authentication page (Admin > Access Management > Remote Authentication).

To configure remote authentication:

1. Choose ADMIN > Access Management > Remote Authentication.

2. Check the Enable Remote Authentication check box.

3. Enter this information about the RADIUS server:

4. To ensure that IoT FND can reach the RADIUS server, click Test Connectivity.

a. Enter your Remote (AD) username and password.

b. Click Submit.

The results of the configuration test displays.

c. Click OK.

5. Click Save when done.

Enabling and Disabling Remote User Accounts

In IoT FND you cannot enable or disable remote AD user accounts. To enable or disable remote AD user accounts, use your AD server.

Deleting Remote User Accounts

In IoT FND, you can delete remote user accounts. However, this only removes the user from the IoT FND Users page (ADMIN > Access Management > Users); it does not delete the user account from AD. If a deleted user logs in to IoT FND and AD authentication is successful, an entry for the user is added to the IoT FND Users page.

Logging In to IoT FND Using a Remote User Account

Logging in to IoT FND using a remote AD user account is transparent to the user. In the background, IoT FND checks whether the account is local, and for remote users sends an authentication request to the RADIUS server configured on the Remote Authentication page (ADMIN > Access Management > Remote Authentication). If both authentication and authorization are successful, IoT FND adds an entry for the user in the Users page (ADMIN > Access Management > Users).

Unlike entries for local users on the Users page, the user name filed in remote user entries is not a link. You cannot click the name of a remote user to obtain more information about the user.

Note: Remote users cannot be managed through IoT FND. If a remote user wants to update their password, they must use their organization’s AD password update tool. Remote users cannot update their password using IoT FND.

Basic User Permissions

IoT FND User Permissions describes basic IoT FND permissions.

System-Defined User Roles

Note: The system-defined Root role cannot be assigned to users.

System-defined User Roles lists system-defined roles. These roles cannot be modified.

Custom User Roles

In IoT FND you can define custom roles. For each role you create, you can assign it one or more basic user permissions (see IoT FND User Permissions). These permissions specify the type of actions users with this role can perform.

Adding Roles

To add IoT FND user roles:

1. Choose ADMIN > Access Management > Roles.

2. Click Add.

3. Enter the name of the role.

4. Check the appropriate check boxes to assign permissions.

5. Click Save.

6. To continue to add roles, click Yes ; otherwise, click No to return to the Roles page.

Deleting Roles

Note: You cannot delete a custom role if it is in use.

To delete IoT FND user roles:

1. Choose ADMIN > Access Management > Roles.

2. Check the check boxes of the roles to delete.

3. Click Delete.

4. Click Yes.

5. Click OK.

Editing Roles

Note: You cannot edit system-defined roles, but you can edit custom roles.

To edit IoT FND custom roles:

1. Choose ADMIN > Access Management > Roles.

2. Click the role to edit.

3. Make changes to the permission assignments by checking or unchecking the relevant check boxes.

4. Click Save.

Viewing Roles

To view IoT FND user roles:

1. Choose ADMIN > Access Management > Roles.

For every role, IoT FND lists the Users assigned to this role and the RADIUS Server VSA.

2. To view permission assignments for the role, click the role link.

Resetting Passwords

As the root user of the Linux server on which IoT FND runs, you can reset your password and use the password utility to reset the password for any other IoT FND user.

To reset a password, enter this command:

IoT FND manages its own user account database; therefore, you must add all new local users from the IoT FND user interface at the Admin > Access Management > Users page. Remote users are automatically added to the database. You can also enable, disable, edit, or delete users on this page.

A user with a disabled account cannot log in until an administrator enables their account. After a user account is active, the user must reset their password. There is no limit to the number of users that you can define on the system other than the available database storage.

Viewing Users

To view IoT FND users, open the Users page (ADMIN > Access Management > Users).

IoT FND displays this information about users:

Adding Users

To add users to IoT FND:

1. Choose ADMIN > Access Management > Users.

2. Click + icon to Add User.

3. Enter the following user information:

4. Click Assign Domain to open the configuration panel:

–Select the domain name from the drop-down menu

–Assign Role(s) and its associated Permission for the user by selecting the role check box.

5. Click Assign to save the entries.

IoT FND creates a record for this user in the IoT FND database.

6. To add the new user, click the Disk icon; otherwise, click X to close the window and return to the Users page.

Note: A new user account is enabled by default. This means that the user can access IoT FND.

You can make future edits to the User entry by selecting the Edit or Delete buttons that appear under the Actions column.

Deleting Users

Deleting user accounts removes user preferences such as the default map location from the system. Disable a user account to temporarily deactivate it.

To delete users from IoT FND:

1. Choose ADMIN > Access Management > Users.

2. Check the box next to the User Name entry that you want to remove from the User Account list.

3. To delete the entry, click the trash can icon.

4. To confirm action, click Yes.

Enabling Users

You must enable the user account for users to access IoT FND. When users log in for the first time, IoT FND prompts them to change their password.

To enable user accounts in IoT FND:

1. Choose Admin > Access Management > Users.

2. Check the check boxes for the user account(s) to enable.

3. Click the solid person icon.

4. To confirm action, click Yes.

Disabling Users

To prevent users from accessing IoT FND, disable their accounts. Disabling user accounts does not delete their records from the IoT FND database.

To disable user accounts in IoT FND:

1. Choose Admin > Access Management > Users.

2. Check the check boxes for the user account(s) to disable.

3. Click the outlined person icon.

Note: If you disable a user account, IoT FND resets the user password.

4. To confirm action, click Yes.

Editing Users

To edit user settings in IoT FND:

1. Choose Admin > Access Management > Users.

2. To edit user credentials:

a. Click the user name link.

b. Edit the role assignments.

c. Click Save.