Step 1

On the menu bar, choose Admin > Authentication > AAA > Policy tab.

Step 2

From the Remote user login policy drop-down list, choose Assign Default Role.

Step 1

In the NX-OS CLI, start in Configuration mode.

apic1#
apic1# configure

Step 2

Configure the aaa user default role.

apic1(config)# aaa user default-role
 assign-default-role  assign-default-role
 no-login             no-login

Step 3

Configure the aaa authentication login methods.

apic1(config)# aaa authentication
 login  Configure methods for login

apic1(config)# aaa authentication login
 console  Configure console methods
 default  Configure default methods
 domain   Configure domain methods

apic1(config)# aaa authentication login console
 <CR>

apic1(config)# aaa authentication login domain
 WORD      Login domain name
 fallback

Step 1

In the APIC, create Login Domain.

1. On the menu bar, choose Admin > Authentication > AAA > Policy tab.

2. In the Properties pane, click the Actions icon > Create Login Domain. You can also create a login domain by clicking + displayed against Login Domains.

3. In the Create Login Domain pane, specify the following:

   • The user configured domain name.

   • Description of the login domain.

   • The realm to verify the identity of an entity (person or device) accessing the fabric devices.The options available in the Realm drop-down list are discussed here:

     1. For Release 4.2(x) and earlier, choose a security method from Local, LDAP, RADIUS, TACACS+, RSA, or SAML for processing authentication requests.

     2. For Release 5.0(x) and later, choose a security method from DUO Proxy LDAP, DUO Proxy Radius, LDAP, RADIUS, TACACS+, RSA, SAML, OAuth 2, or Local for processing authentication requests.

        Note

        If LDAP, RADIUS, or TACACS+ is specified as the default security method and the associated provider group specified in this dialog is not available to provide authentication during a user login, fallback local authentication is not executed by the APIC server unless is specifically configured to do so.

   • A RADIUS provider group for a group of remote servers supporting the RADIUS protocol for authentication.

   • A TACACS+ provider group for a group of remote servers supporting the TACACS+ protocol for authentication.

   • An LDAP provider group for a group of remote servers supporting the LDAP protocol for authentication.

   • A RSA provider group for a group of remote servers supporting the RSA protocol for authentication.

   • A SAML provider group for a group of remote servers supporting the SAML protocol for authentication.

   • An OAuth 2 provider group for a group of remote servers supporting the OAuth 2 protocol for authentication.

Step 2

Click Submit.

Step 1

In the APIC, create the RADIUS provider.

1. On the menu bar, choose Admin > Authentication > RADIUS tab.

2. Click the Actions icon > Create RADIUS Provider.

3. In the displayed pop-up window, specify the RADIUS host name (or IP address), description, port, protocol, key, timeout, retries, management endpoint group, and select if server monitoring needs to be enabled or not. .

   Note

   If the APIC is configured for in-band management connectivity, out-of-band management does not work for authentication. With the APIC release2.1(1x), you can set a global toggle between In-band and out-of-band as the default management connectivity between the APIC server and other external management devices. For toggling in-band or out-of-band management in the APIC GUI: Prior to Release 2.2(1x): In the Navigation pane, choose Fabric > Fabric Policies > Global Policies > Connectivity Preferences. In the Work Pane select either inband or ooband. For Release 2.2(x) and 2.3(x): In the Navigation pane, choose Fabric > Fabric Policies > Global Policies > APIC Connectivity Preferences. In the Work Pane select either inband or ooband. For Release 3.0(1x) or later: In the Navigation pane, choose System > System Settings > APIC Connectivity Preferences. In the Work Pane select either inband or ooband.

Step 2

Create the Login Domain for TACACS+.

Step 1

In the APIC, create the TACACS+ Provider.

1. On the menu bar, choose Admin > Authentication > TACACS tab.

2. Click the Actions icon > Create TACACS+ Provider.

3. In the displayed pop-up window, specify the TACACS+ host name (or IP address), description, port, authorization protocol, key, timeout, retries, management endpoint group, and select if server monitoring needs to be enabled or not.

   Note

   If the APIC is configured for in-band management connectivity, out-of-band management does not work for authentication. With the APIC release2.1(1x), you can set a global toggle between In-band and out-of-band as the default management connectivity between the APIC server and other external management devices. For toggling in-band or out-of-band management in the APIC GUI: Prior to Release 2.2(1x): In the Navigation pane, choose Fabric > Fabric Policies > Global Policies > Connectivity Preferences. In the Work Pane select either inband or ooband. For Release 2.2(x) and 2.3(x): In the Navigation pane, choose Fabric > Fabric Policies > Global Policies > APIC Connectivity Preferences. In the Work Pane select either inband or ooband. For Release 3.0(1x) or later: In the Navigation pane, choose System > System Settings > APIC Connectivity Preferences. In the Work Pane select either inband or ooband.

Step 2

Create the Login Domain for TACACS+.

Step 1

Log in to the ACS server to configure the APIC as a client.

1. Navigate to Network Resources > Network Devices Groups > Network Devices and AAA Clients.

2. Specify the client name, the APIC in-band IP address, select the TACACS+ or RADIUS (or both) authentication options.

   Note	If the only RADIUS or TACACS+ authentication is needed, select only the needed option.

3. Specify the authentication details such as Shared Secret (key), and port as appropriate for the authentication option(s).

   Note	The Shared Secret(s) must match the APIC Provider key(s).

Step 2

Create the Identity Group.

1. Navigate to Users and Identity Stores > Internal Groups option.

2. Specify the Name, and Parent Group as appropriate.

Step 3

Map users to the Identity Group.

1. In the Navigation pane, click the Users and Identity Stores > Internal Identity Stores > Users option.

2. Specify the user Name, and Identity Group as appropriate.

Step 4

Create the Policy Element.

1. Navigate to the Policy Elements option.

2. For RADIUS, specify the Authorization and Permissions > Network Access > Authorization Profiles Name. For TACACS+, specify the Authorization and Permissions > Device Administration > Shell Profile Name as appropriate.

3. For RADIUS, specify the Attribute as cisco-av-pair, Type as string, and the Value as shell:domains = <domain>/<role>/,<domain>// role as appropriate. For TACACS+, specify the Attribute as cisco-av-pair, Requirement as Mandatory, and the Value as shell:domains = <domain>/<role>/,<domain>// role as appropriate.

   The syntax of the Value field determines whether write privileges are granted:

   • For read/write privileges, the syntax is shell:domains = <domain>/<role>/.

   • For read-only privileges, the syntax is shell:domains = <domain>// <role>.

   For example, if the cisco-av-pair has a value of shell:domains = solar/admin/,common// read-all, then solar is the security domain, admin is the role that gives write privileges to this user in the security domain called solar, common is the tenant common, and read-all is the role with read privileges that gives this user read privileges to all of the tenant common.

Step 5

Create a service selection rule.

1. For RADIUS, create a service selection rule to associate the Identity Group with the Policy Element by navigating to Access Policies > Default Device Network Access Identity > Authorization and specifying the rule Name, Status, and Conditions as appropriate, and Add the Internal Users:UserIdentityGroup in ALL Groups:<identity group name>.

2. For TACACS+, create a service selection rule to associate the Identity Group with the Shell Profile by navigating to Access Policies > Default Device Admin Identity > Authorization. Specify the rule Name, Conditions, and Select the Shell Profile as appropriate.

Step 1

In the APIC, configure the DUO RADIUS proxy provider.

1. On the menu bar, choose Admin > Authentication > DUO > Radius tab.

2. Click the Actions icon > Create DUO Radius Proxy Provider from the menu.

3. In the displayed pop-up window, specify the following:

   • The hostname or IP address of the DUO RADIUS proxy provider.

   • The description of the DUO RADIUS proxy provider.

   • The authentication port number for the RADIUS service. The range is from 1 to 65535. The default is 1812.

   • Key is the secret text string shared between the device and a specific DUO RADIUS proxy server.

   • The timeout for communication with a DUO RADIUS proxy provider server. The range is from 1 to 60 seconds. The default is 30 seconds. If set to 0, the AAA provider timeout is used.

   • The number of retries when contacting the RADIUS endpoint. The range is from 0 to 5 retries. The default is 1.

   • The out-of-band management EPG used to communicate with the DUO RADIUS service.

   • Enabling Server Monitoring allows the connectivity of the remote AAA servers to be tested.

Step 2

Click Submit.

Step 1

In the APIC, configure the DUO LDAP proxy provider.

1. On the menu bar, choose Admin > Authentication > DUO > LDAP > Providers tab.

2. Click the Actions icon > Create DUO LDAP Proxy Provider.

3. In the displayed pop-up window, specify the following:

   • The hostname or IP address of the DUO LDAP proxy provider.

   • The description of the DUO LDAP proxy provider.

   • The service port number for the LDAP service. The range is from 1 to 65535. The default is 389.

   • The Bind DN is the string that the APIC uses to log in to the DUO LDAP proxy server.

   • The DUO LDAP base DN to be used in a user search.

   • The password for the DUO LDAP database account specified in the Bind DN field.

   • The timeout for communication with an DUO LDAP proxy provider server. The range is from 0 to 60 seconds. The default is 30 seconds. If set to 0, the AAA provider timeout is used.

   • The number of retries when contacting the DUO LDAP proxy endpoint.

   • Enables an SSL connection with the DUO LDAP proxy provider. The default is disabled.

   • The attribute to be downloaded that contains user role and domain information.

     1. For DUO LDAP proxy provider server configurations with a Cisco AVPair, enter CiscoAVPair.

     2. For DUO LDAP proxy provider server configurations with a DUO LDAP proxy group map, enter memberOf.

        Note	For DUO LDAP configurations, best practice is to use AciCiscoAVPair as the attribute. This avoids problems related to the limitation DUO LDAP proxy servers not allowing overlapping object identifiers (OID); that is, the ciscoAVPair OID is already in use.

   • The out-of-band management EPG used to communicate with the DUO LDAP proxy server.

   • The DUO LDAP proxy provider server SSL Certificate validation level. The value can be:

     1. Permissive—A debugging knob to help diagnose DUO LDAP SSL Certificate issues.

     2. Strict—A level that should be used when in production.

   • The DUO LDAP filter to be used in a user search.

   • Enabling Server Monitoring allows the connectivity of the remote AAA servers to be tested.

Step 2

Click Submit.

Step 1

In the APIC, create the RSA provider.

1. On the menu bar, choose Admin > Authentication > RSA tab.

2. Click the Actions icon > Create RSA Provider .

3. In the displayed pop-up window, specify the RSA host name (or IP address), port, protocol, and management endpoint group.

Step 2

Create the login domain for RSA.

Step 3

Create the Login Domain for RSA.

Step 1

In the Cisco APIC GUI, create the SAML Provider.

1. On the menu bar, choose Admin > AAA .

2. In the Navigation pane, choose Authentication .

3. In the Work pane, choose SAML > Providers.

4. Choose Actions > Create SAML Provider.

5. Specify the SAML host name (or IP address), and description (optional).

6. Choose the Identity Provider.

7. Specify the Entity ID for the SAML-based service.

8. Enter the Metadata URL provided by IDP.

   • For ADFS, the IdP Metadata URL is of the format https://<FQDN of ADFS>/FederationMetadata/2007-06/FederationMetadata.xml.

9. Configure the HTTPS Proxy if it is needed to access the IdP metadata URL.

10. Choose the Certificate Authority if IdP is signed by a Private CA.

11. Choose the Timeout (in seconds) value.

12. Choose the Signature Algorithm for Requests authentication type for the user requests from the drop-down list.

13. Put a check in the Sign SAML Auth Requests check box to enable signing SAML authentication requests.

14. Put a check in the Sign SAML Response Message check box to enable signing SAML response messages.

15. Put a check in the Sign Assertions in SAML Response check box to enable signing assertions in SAML responses.

16. Put a check in the Encrypt SAML Assertions check box to enable encryption in SAML assertions.

Step 2

Create the Login Domain for SAML.

Step 1

Add relying party trust:

1. Login to AD FS Management Console on your AD FS server, Navigate to ADFS > Trust Relationships > Relying Party Trusts and right-click on Add Relying Party Trust and click Start.

2. Choose Enter data about the relying party manually or Import data about relying party from a file (skip the steps d, e, f and g) by importing the metadata file generated using the Download SAML Metadata option available on the corresponding login domain setup in APIC.

3. Enter your preferred Display Name for the relying party trust and click Next.

4. Choose AD FS Profile and click Next.

5. Click Next again.

6. Select Enable support for the SAML 2.0 Web SSO Protocol and enter Relying party SAML2.0 SSO service UR as https://<APIC_hostname>/api/aaaLoginSSO.json?name=<Login_domain_name> and click Next.

7. Enter the Relying party trust identifier – https://<APIC_hostname>/api/aaaLoginSSO.json

8. Choose I do not want to configure multi-factor authentication settings for this relying party trust at this time and click Next.

9. Choose Permit all users to access this relying party and click Next.

10. Select Open the Edit Claim rules dialog for this relying party trust when the wizard closes and click Close.

Step 2

Add the following Claim rules:

1. Send LDAP Attributes as claims:

   • In the Edit Claim Rules window, click Add Rule.

   • Select the Claim Rule Template as Send LDAP attributes as Claims and click Next.

   • Enter a Rule_Name and select Active Directory as the Attribute Store.

   • Select the reserved User Attribute for storing CiscoAvpair (For Ex: Department) as LDAP attribute type and map it to Outgoing Claim Manually Type as CiscoAvpair.

   • Select E-Mail-Addresses on LDAP Attribute and map it to the Outgoing Claim Type E-mail Address and click Finish.

2. Transform an Incoming Claim:

   • Click Add Rule again in the Edit Claim Rules window, and select Transform an Incoming Claim as Claim Rule Template and click Next.

   • Select E-Mail Address as the Incoming claim type.

   • Select Name ID as Outgoing claim type.

   • Select Transient Identifier as Outgoing name ID format.

Step 3

To add a cluster of APICs, one can either setup multiple Relying Party Trusts or setup single Relying Party Trust and add multiple Relying Party Identifiers and SAML Assertion Consumer Endpoints to it.

1. Adding other APICs in a cluster with same relying party trusts created above.

   1. Navigate to ADFS Management Console > ADFS > Trust Relationships > Relying Party Trusts and right-click on CiscoAPIC > Properties.

   2. Click on Identifiers tab and add other APICs in cluster as: https://<APIC2_hostname>/api/aaaLoginSSO.json, https://<APIC3_hostname>/api/aaaLoginSSO.json

   3. Click on Endpoints tab and Other two APICs by clicking on Add SAML. Add SAML Post Binding, Index as 1 and Enter trusted URL as: https://<APIC2_hostname>/api/aaaLoginSSO.json?name=<Login_domain_name>, and Add SAML Post Binding as: https://<APIC3_hostname>/api/aaaLoginSSO.json?name=<Login_domain_name>.

Step 4

Message and Assertion need to be signed in ADFS from powershell in ADFS server. For Signing Message and Assertion in ADFS Server:

1. Open Windows Powershell (should be run as Administrator) and execute the below command:

2. Set-AdfsRelyingPartyTrust -TargetName RelyingpartytrustnameOfCiscoAPIC -SamlResponseSignature MessageAndAssertion.

Step 1

Create OAuth Provider.

<aaaOauthProvider name="app.idpserver1.com" dn="uni/userext/oauthext/oauthprovider-app.idpserver1.com"
  status="created,modified"
  httpsProxy="https://proxy.foo.com:8080"  retries="1" timeout="5"
     usernameAttr="sub" 
     scope="openid"      
  authzEndpoint="https://app.idpserver1.com/oauth2/abc123/v1/authorize"
  tokenEndpoint="https://app.idpserver1.com/oauth2/abc123/v1/token"
  clientId="clientId1"
  secret="secret1" 
  tp="idpcertchain" />

Step 2

Create OAuth Login Domain.

<aaaUserEp dn="uni/userext" status="created,modified">
  <aaaPingEp dn="uni/userext/pingext" pingCheck="false" retries="1" status="modified" timeout="5"/>
  <aaaLoginDomain dn="uni/userext/logindomain-TOAUTH" name="TOAUTH" status="created,modified">
    <aaaDomainAuth dn="uni/userext/logindomain-TOAUTH/domainauth" providerGroup="TOAUTH" realm="oauth" realmSubType="default" status="created,modified"/>
  </aaaLoginDomain>
  <aaaOauthEp rn="oauthext" status="modified">
    <aaaOauthProviderGroup dn="uni/userext/oauthext/oauthprovidergroup-TOAUTH" name="TOAUTH" status="created,modified">
      <aaaProviderRef dn="uni/userext/oauthext/oauthprovidergroup-TOAUTH/providerref-app.idpserver1.com" name="app.idpserver1.com" order="1" status="created,modified"/>
    </aaaOauthProviderGroup>
  </aaaOauthEp>
</aaaUserEp>