- Preface
-
- Configuring the Fabric Interconnects
- Configuring Ports and Port Channels
- Configuring Communication Services
- Configuring Authentication
- Configuring Organizations
- Configuring Role-Based Access Control
- Managing Firmware
- Configuring DNS Servers
- Configuring System-Related Policies
- Managing Licenses
- Managing Virtual Interfaces
- Index
Cisco UCS Manager GUI Configuration Guide, Release 2.0
Bias-Free Language
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
- Updated:
- February 9, 2014
Chapter: Configuring Authentication
- Authentication Services
- Guidelines and Recommendations for Remote Authentication Providers
- User Attributes in Remote Authentication Providers
- LDAP Group Rule
- Configuring LDAP Providers
- Configuring RADIUS Providers
- Configuring TACACS+ Providers
- Configuring Multiple Authentication Systems
- Multiple Authentication Systems
- Provider Groups
- Creating an LDAP Provider Group
- Deleting an LDAP Provider Group
- Creating a RADIUS Provider Group
- Deleting a RADIUS Provider Group
- Creating a TACACS+ Provider Group
- Deleting a TACACS+ Provider Group
- Authentication Domains
- Creating an Authentication Domain
- Selecting a Primary Authentication Service
Configuring Authentication
This chapter includes the following sections:
- Authentication Services
- Guidelines and Recommendations for Remote Authentication Providers
- User Attributes in Remote Authentication Providers
- LDAP Group Rule
- Configuring LDAP Providers
- Configuring RADIUS Providers
- Configuring TACACS+ Providers
- Configuring Multiple Authentication Systems
- Selecting a Primary Authentication Service
Authentication Services
Cisco UCS supports two methods to authenticate user logins:
Guidelines and Recommendations for Remote Authentication Providers
If a system is configured for one of the supported remote authentication services, you must create a provider for that service to ensure that Cisco UCS Manager can communicate with it. In addition, you need to be aware of the following guidelines that impact user authorization:
User Accounts in Remote Authentication Services
User accounts can exist locally in Cisco UCS Manager or in the remote authentication server.
The temporary sessions for users who log in through remote authentication services can be viewed through Cisco UCS Manager GUI or Cisco UCS Manager CLI.
User Roles in Remote Authentication Services
If you create user accounts in the remote authentication server, you must ensure that the accounts include the roles those users require for working in Cisco UCS Manager and that the names of those roles match the names used in Cisco UCS Manager. Depending on the role policy, a user may not be allowed to log in or will be granted only read-only privileges.
User Attributes in Remote Authentication Providers
For RADIUS and TACACS+ configurations, you must configure a user attribute for Cisco UCS in each remote authentication provider through which users log in to Cisco UCS Manager. This user attribute holds the roles and locales assigned to each user.
 Note |
This step is not required for LDAP configurations that use LDAP Group Mapping to assign roles and locales. |
When a user logs in, Cisco UCS Manager does the following:
- Queries the remote authentication service.
- Validates the user.
- If the user is validated, checks for the roles and locales assigned to that user.
Sample OID for LDAP User Attribute
The following is a sample OID for a custom CiscoAVPair attribute:
CN=CiscoAVPair,CN=Schema, CN=Configuration,CN=X objectClass: top objectClass: attributeSchema cn: CiscoAVPair distinguishedName: CN=CiscoAVPair,CN=Schema,CN=Configuration,CN=X instanceType: 0x4 uSNCreated: 26318654 attributeID: 1.3.6.1.4.1.9.287247.1 attributeSyntax: 2.5.5.12 isSingleValued: TRUE showInAdvancedViewOnly: TRUE adminDisplayName: CiscoAVPair adminDescription: UCS User Authorization Field oMSyntax: 64 lDAPDisplayName: CiscoAVPair name: CiscoAVPair objectCategory: CN=Attribute-Schema,CN=Schema,CN=Configuration,CN=X
LDAP Group Rule
The LDAP group rule is used to determine whether Cisco UCS should use LDAP groups when assigning user roles and locales to a remote user.
Configuring LDAP Providers
Configuring Properties for LDAP Providers
The properties that you configure in this task are the default settings for all provider connections of this type defined in Cisco UCS Manager. If an individual provider includes a setting for any of these properties, Cisco UCS uses that setting and ignores the default setting.
If you are using Active Directory as your LDAP server, create a user account in the Active Directory server to bind with Cisco UCS. This account should be given a non-expiring password.
What to Do Next
Create an LDAP provider.
Creating an LDAP Provider
Cisco UCS Manager supports a maximum of 16 LDAP providers.
If you are using Active Directory as your LDAP server, create a user account in the Active Directory server to bind with Cisco UCS. This account should be given a non-expiring password.
-
In the LDAP server, perform one of the following configurations:
- Configure LDAP groups. LDAP groups contain user role and locale information.
- Configure users with the attribute that holds the user role and locale information for Cisco UCS Manager. You can choose whether to extend the LDAP schema for this attribute. If you do not want to extend the schema, use an existing LDAP attribute to hold the Cisco UCS user roles and locales. If you prefer to extend the schema, create a custom attribute, such as the CiscoAVPair attribute. The Cisco LDAP implementation requires a unicode type attribute. If you choose to create the CiscoAVPair custom attribute, use the following attribute ID: 1.3.6.1.4.1.9.287247.1
- For a cluster configuration, add the management port IP addresses for both fabric interconnects. This configuration ensures that remote users can continue to log in if the first fabric interconnect fails and the system fails over to the second fabric interconnect. All login requests are sourced from these IP addresses, not the virtual IP address used by Cisco UCS Manager.
- If you want to use secure communications, create a trusted point containing the certificate of the root certificate authority (CA) of the LDAP server in Cisco UCS Manager.
| Step 1 | In the Navigation pane, click the Admin tab. |
| Step 2 | On the Admin tab, expand . |
| Step 3 | In the Work pane, click the General tab. |
| Step 4 | In the Actions area, click Create LDAP Provider. |
| Step 5 |
On the Create LDAP Provider page of the wizard, do the following:
|
| Step 6 |
On the LDAP Group Rule page of the wizard, do the following:
|
What to Do Next
For implementations involving a single LDAP database, select LDAP as the authentication service.
For implementations involving multiple LDAP databases, configure an LDAP provider group.
Changing the LDAP Group Rule for an LDAP Provider
| Step 1 | In the Navigation pane, click the Admin tab. | ||||||||||
| Step 2 | On the Admin tab, expand . | ||||||||||
| Step 3 | Expand LDAP Providers and choose the LDAP provider for which you want to change the group rule. | ||||||||||
| Step 4 | In the Work pane, click the General tab. | ||||||||||
| Step 5 |
In the LDAP Group Rules area, complete the following fields:
|
||||||||||
| Step 6 | Click Save Changes. |
Deleting an LDAP Provider
| Step 1 | In the Navigation pane, click the Admin tab. |
| Step 2 | On the Admin tab, expand . |
| Step 3 | Expand LDAP Providers. |
| Step 4 | Right-click the LDAP provider you want to delete and choose Delete. |
| Step 5 | If the Cisco UCS Manager GUI displays a confirmation dialog box, click Yes. |
LDAP Group Mapping
For organizations that already use LDAP groups to restrict access to LDAP databases, group membership information can be used by UCSM to assign a role or locale to an LDAP user during login. This eliminates the need to define role or locale information in the LDAP user object when Cisco UCS Manager is deployed.
When a user logs in to Cisco UCS Manager, information about the user's role and locale are pulled from the LDAP group map. If the role and locale criteria match the information in the policy, access is granted.
Role and locale definitions are configured locally in Cisco UCS Manager and do not update automatically based on changes to an LDAP directory. When deleting or renaming LDAP groups in an LDAP directory, it is important that you update Cisco UCS Manager with the change.
Note |
Cisco UCS Manager includes many out-of-the-box user roles but does not include any locales. Mapping an LDAP provider group to a locale requires that you create a custom locale. |
Creating an LDAP Group Map
| Step 1 | In the Navigation pane, click the Admin tab. |
| Step 2 | On the Admin tab, expand . |
| Step 3 | Right-click LDAP Group Maps and choose Create LDAP Group Map. |
| Step 4 |
In the Create LDAP Group Map dialog box, do the following:
|
What to Do Next
Set the LDAP group rule.
Deleting an LDAP Group Map
| Step 1 | In the Navigation pane, click the Admin tab. |
| Step 2 | On the Admin tab, expand . |
| Step 3 | Expand LDAP Group Maps. |
| Step 4 | Right-click the LDAP group map you want to delete and choose Delete. |
| Step 5 | If the Cisco UCS Manager GUI displays a confirmation dialog box, click Yes. |
Configuring RADIUS Providers
Configuring Properties for RADIUS Providers
The properties that you configure in this task are the default settings for all provider connections of this type defined in Cisco UCS Manager. If an individual provider includes a setting for any of these properties, Cisco UCS uses that setting and ignores the default setting.
| Step 1 | In the Navigation pane, click the Admin tab. | ||||||
| Step 2 | In the Admin tab, expand . | ||||||
| Step 3 |
Complete the following fields in the Properties area:
|
||||||
| Step 4 | Click Save Changes. |
What to Do Next
Create a RADIUS provider.
Creating a RADIUS Provider
Cisco UCS Manager supports a maximum of 16 RADIUS providers.
Perform the following configuration in the RADIUS server:
- Configure users with the attribute that holds the user role and locale information for Cisco UCS Manager. You can choose whether to extend the RADIUS schema for this attribute. If you do not want to extend the schema, use an existing RADIUS attribute to hold the Cisco UCS user roles and locales. If you prefer to extend the schema, create a custom attribute, such as the cisco-avpair attribute. The vendor ID for the Cisco RADIUS implementation is 009 and the vendor ID for the attribute is 001. The following syntax example shows how to specify multiples user roles and locales if you choose to create the cisco-avpair attribute: shell:roles="admin,aaa" shell:locales="L1,abc". Use a comma "," as the delimiter to separate multiple values.
- For a cluster configuration, add the management port IP addresses for both fabric interconnects. This configuration ensures that remote users can continue to log in if the first fabric interconnect fails and the system fails over to the second fabric interconnect. All login requests are sourced from these IP addresses, not the virtual IP address used by Cisco UCS Manager.
| Step 1 | In the Navigation pane, click the Admin tab. |
| Step 2 | On the Admin tab, expand . |
| Step 3 |
In the Create RADIUS Provider dialog box:
|
| Step 4 | Click Save Changes. |
What to Do Next
For implementations involving a single RADIUS database, select RADIUS as the primary authentication service.
For implementations involving multiple RADIUS databases, configure a RADIUS provider group.
Deleting a RADIUS Provider
| Step 1 | In the Navigation pane, click the Admin tab. |
| Step 2 | In the Admin tab, expand . |
| Step 3 | Right-click the RADIUS provider you want to delete and choose Delete. |
| Step 4 | If the Cisco UCS Manager GUI displays a confirmation dialog box, click Yes. |
Configuring TACACS+ Providers
Configuring Properties for TACACS+ Providers
The properties that you configure in this task are the default settings for all provider connections of this type defined in Cisco UCS Manager. If an individual provider includes a setting for any of these properties, Cisco UCS uses that setting and ignores the default setting.
| Step 1 | In the Navigation pane, click the Admin tab. |
| Step 2 | In the Admin tab, expand . |
| Step 3 |
In the Properties area, complete the Timeout field: The length of time in seconds the system should spend trying to contact the TACACS+ database before it times out. Enter an integer from 1 to 60 seconds, or enter 0 (zero) to use the global timeout value specified on the TACACS+ General tab. The default is 5 seconds. |
| Step 4 | Click Save Changes. |
What to Do Next
Create an TACACS+ provider.
Creating a TACACS+ Provider
Cisco UCS Manager supports a maximum of 16 TACACS+ providers.
Perform the following configuration in the TACACS+ server:
- Create the cisco-av-pair attribute. You cannot use an existing TACACS+ attribute. The cisco-av-pair name is the string that provides the attribute ID for the TACACS+ provider. The following syntax example shows how to specify multiples user roles and locales when you create the cisco-av-pair attribute: cisco-av-pair=shell:roles="admin aaa" shell:locales*"L1 abc". Using an asterisk (*) in the cisco-av-pair attribute syntax flags the locale as optional, preventing authentication failures for other Cisco devices that use the same authorization profile. Use a space as the delimiter to separate multiple values.
- For a cluster configuration, add the management port IP addresses for both fabric interconnects. This configuration ensures that remote users can continue to log in if the first fabric interconnect fails and the system fails over to the second fabric interconnect. All login requests are sourced from these IP addresses, not the virtual IP address used by Cisco UCS Manager.
| Step 1 | In the Navigation pane, click the Admin tab. |
| Step 2 | On the Admin tab, expand . |
| Step 3 | In the Actions area of the General tab, click Create TACACS+ Provider. |
| Step 4 |
In the Create TACACS+ Provider dialog box:
|
| Step 5 | Click Save Changes. |
What to Do Next
For implementations involving a single TACACS+ database, select TACACS+ as the primary authentication service.
For implementations involving multiple TACACS+ databases, configure a TACACS+ provider group.
Deleting a TACACS+ Provider
| Step 1 | In the Navigation pane, click the Admin tab. |
| Step 2 | In the Admin tab, expand . |
| Step 3 | Right-click the TACACS+ provider you want to delete and choose Delete. |
| Step 4 | If the Cisco UCS Manager GUI displays a confirmation dialog box, click Yes. |
Configuring Multiple Authentication Systems
Multiple Authentication Systems
You can configure Cisco UCS to use multiple authentication systems by configuring the following features:
Provider Groups
A provider group is a set of providers that will be used by Cisco UCS during the authentication process. Cisco UCS Manager allows you to create a maximum of 16 provider groups, with a maximum of eight providers allowed per group.
During authentication, all the providers within a provider group are tried in order. If all of the configured servers are unavailable or unreachable, Cisco UCS Manager automatically falls back to the local authentication method using the local username and password.
Creating an LDAP Provider Group
Note |
Authenticating with a single LDAP database does not require you to set up an LDAP provider group. |
Create one or more LDAP providers.
| Step 1 | In the Navigation pane, click the Admin tab. |
| Step 2 | On the Admin tab, expand . |
| Step 3 | Right-click LDAP Provider Groups and choose Create LDAP Provider Group. |
| Step 4 |
In the Create LDAP Provider Group dialog box, do the following:
|
What to Do Next
Configure an authentication domain or select a default authentication service.
Deleting an LDAP Provider Group
Remove the provider group from an authentication configuration.
| Step 1 | In the Navigation pane, click the Admin tab. |
| Step 2 | On the Admin tab, expand . |
| Step 3 | Expand LDAP Provider Groups. |
| Step 4 | Right-click the LDAP provider group you want to delete and choose Delete. |
| Step 5 | If the Cisco UCS Manager GUI displays a confirmation dialog box, click Yes. |
Creating a RADIUS Provider Group
Note |
Authenticating with a single RADIUS database does not require you to set up a RADIUS provider group. |
Create one or more RADIUS providers.
| Step 1 | In the Navigation pane, click the Admin tab. |
| Step 2 | On the Admin tab, expand . |
| Step 3 | Right-click RADIUS Provider Groups and choose Create RADIUS Provider Group. |
| Step 4 |
In the Create RADIUS Provider Group dialog box, do the following:
|
What to Do Next
Configure an authentication domain or select a default authentication service.
Deleting a RADIUS Provider Group
You cannot delete a provider group if it is being used by an authentication configuration.
| Step 1 | In the Navigation pane, click the Admin tab. |
| Step 2 | On the Admin tab, expand . |
| Step 3 | Expand RADIUS Provider Groups. |
| Step 4 | Right-click the RADIUS provider group you want to delete and choose Delete. |
| Step 5 | If the Cisco UCS Manager GUI displays a confirmation dialog box, click Yes. |
Creating a TACACS+ Provider Group
Note |
Authenticating with a single TACACS+ database does not require you to set up a TACACS+ provider group. |
Create one or more TACACS+ providers.
| Step 1 | In the Navigation pane, click the Admin tab. |
| Step 2 | On the Admin tab, expand . |
| Step 3 | Right-click TACACS+ Provider Groups and choose Create TACACS+ Provider Group. |
| Step 4 |
In the Create TACACS+ Provider Group dialog box, do the following:
|
Deleting a TACACS+ Provider Group
You cannot delete a provider group if it is being used by an authentication configuration.
| Step 1 | In the Navigation pane, click the Admin tab. |
| Step 2 | On the Admin tab, expand . |
| Step 3 | Expand TACACS+ Provider Groups. |
| Step 4 | Right-click the TACACS+ provider group you want to delete and choose Delete. |
| Step 5 | If the Cisco UCS Manager GUI displays a confirmation dialog box, click Yes. |
Authentication Domains
Authentication domains are used by Cisco UCS Manager to leverage multiple authentication systems. Each authentication domain is specified and configured during login. If no authentication domain is specified, the default authentication service configuration is used.
You can create up to eight authentication domains. Each authentication domain is associated with a provider group and realm in Cisco UCS Manager. If no provider group is specified, all servers within the realm are used.
Creating an Authentication Domain
| Step 1 | In the Navigation pane, click the Admin tab. | ||||||||||||||
| Step 2 | On the Admin tab, expand . | ||||||||||||||
| Step 3 | Right-click Authentication Domains and choose Create a Domain. | ||||||||||||||
| Step 4 |
In the Create a Domain dialog box, complete the following fields:
|
||||||||||||||
| Step 5 | Click OK. |
Selecting a Primary Authentication Service
Selecting the Console Authentication Service
If the system uses a remote authentication service, create a provider for that authentication service. If the system uses only local authentication through Cisco UCS, you do not need to create a provider first.
| Step 1 | In the Navigation pane, click the Admin tab. | ||||||
| Step 2 | On the Admin tab, expand . | ||||||
| Step 3 | Click Native Authentication. | ||||||
| Step 4 | In the Work pane, click the General tab. | ||||||
| Step 5 |
In the Console Authentication area, complete the following fields:
|
||||||
| Step 6 | Click Save Changes. |
Selecting the Default Authentication Service
If the system uses a remote authentication service, create a provider for that authentication service. If the system uses only local authentication through Cisco UCS, you do not need to create a provider first.
| Step 1 | In the Navigation pane, click the Admin tab. | ||||||
| Step 2 | On the Admin tab, expand . | ||||||
| Step 3 | Click Native Authentication. | ||||||
| Step 4 | In the Work pane, click the General tab. | ||||||
| Step 5 |
In the Default Authentication area, complete the following fields:
|
||||||
| Step 6 | Click Save Changes. |
Role Policy for Remote Users
By default, if user roles are not configured in Cisco UCS Manager read-only access is granted to all users logging in to Cisco UCS Manager from a remote server using the LDAP, RADIUS, or TACACS protocols. For security reasons, it might be desirable to restrict access to those users matching an established user role in Cisco UCS Manager.
- assign-default-role
-
Does not restrict user access to Cisco UCS Manager based on user roles. Read-only access is granted to all users unless other user roles have been defined in Cisco UCS Manager.
This is the default behavior.
- no-login
-
Restricts user access to Cisco UCS Manager based on user roles. If user roles have not been assigned for the remote authentication system, access is denied.
Configuring the Role Policy for Remote Users
| Step 1 | In the Navigation pane, click the Admin tab. |
| Step 2 | On the Admin tab, expand . |
| Step 3 | Click Native Authentication. |
| Step 4 | In the Work pane, click the General tab. |
| Step 5 | In the Role Policy for Remote Users field, click one of the following radio buttons to determine what happens when a user attempts to log in and the remote authentication provider does not supply a user role with the authentication information: |
| Step 6 | Click Save Changes. |
Feedback