Table of Contents

Preface

Overview

Using the UCP Web Services

Using the Monitoring and Report Viewer Web Services

Using the REST Web Services

Using the Scripting Interface

Monitoring and Report Viewer Database Schema

Title Page

Preface

Welcome to the Software Developer Guide for Cisco Secure Access Control System 5.8!

This document provides details about the interfaces that Cisco Secure Access Control System (ACS) offers that you can use to interact with external customer-developed applications.

This includes several web services for application access and scriptable access for bulk provisioning using the command-line interface (CLI). It also allows you to create a replica of the Monitoring and Troubleshooting database for application development.

Audience

This guide is intended for software engineers and programmers who create custom applications to interact with ACS. The software engineers and programmers must be familiar with:

n Web Services Description Language (WSDL) File

n Web Application Description Language (WADL) File

n Web Services Tools

n REST Services Tools

How This Guide Is Organized

Table 1 Organization

S.No

Title

Description

1

Overview

Provides an overview of the ACS 5.8 features in the form of web services. It also gives CLI commands that you can use in your custom applications to interact with ACS.

2

Using the UCP Web Service

Describes the User Change Password web service, the methods that it provides, and how you can use it in your application.

3

Using the Monitoring and Report Viewer Web Services

Describes the web services that the Monitoring and Report Viewer component of ACS provides, and it also explains how to use these web services in your application.

4

Using the Configuration Web Services

Describes the Configuration Web Services, the CRUD methods that it provides, and explains how to use it in your application.

5

Using the Scripting Interface

Describes the scripting interface that ACS provides. This interface allows you to perform bulk create, update, and delete operations on various ACS objects.

6

Monitoring and Report Viewer Database Schema

Provides the Monitoring and Report Viewer database schema that allows you to create custom reporting applications.

Conventions

Table 2 describes the conventions followed in this document.

Table 2 Conventions

Convention

Description

bold font

Commands and keywords.

italic font

Variables for which you supply values.

[ ]

Keywords or arguments that appear within square brackets are optional.

{x | y | z }

A choice of required keywords appears in braces separated by vertical bars. You must select one.

[ x | y | z ]

Optional alternative keywords are grouped in brackets separated by vertical bars.

string

Nonquoted set of characters. Do not use quotation marks around the string or the string will include the quotation marks.

courier font

Examples of information displayed on the screen.

bold courier font

Examples of information you must enter.

< >

Nonprinting characters, such as passwords, appear in angle brackets.

[ ]

Default responses to system prompts appear in square brackets.

!, #

An exclamation point (!) or a pound sign (#) at the beginning of a line of code indicates a comment line.

. Notes contain helpful suggestions or references to material not covered in the manual.

. You can save time by performing the action described in the paragraph.

Documentation Updates

Table 3 Updates to the Software Developer’s Guide for Cisco Secure Access Control System 5.8

Date

Description

9/29/2015

Cisco Secure Access Control System Release 5.8.

Related Documentation

Table 4 lists a set of related technical documentation available on Cisco.com. To find end-user documentation for all products on Cisco.com, go to:

http://www.cisco.com/go/techdocs

for any updates.

Table 4 Product Documentation

Document Title

Available Formats

Cisco Secure Access Control System In-Box Documentation and China RoHS Pointer Card

http://www.cisco.com/c/en/us/support/security/

secure-access-control-system/products-documentation-roadmaps-list.html

Migration Guide for Cisco Secure Access Control System 5.8

http://www.cisco.com/c/en/us/support/security/

secure-access-control-system/products-installation-guides-list.html

User Guide for Cisco Secure Access Control System 5.8

http://www.cisco.com/c/en/us/support/security/

secure-access-control-system/products-user-guide-list.html

CLI Reference Guide for Cisco Secure Access Control System 5.8

http://www.cisco.com/c/en/us/support/security/

secure-access-control-system/products-command-reference-list.html

Supported and Interoperable Devices and Software for Cisco Secure Access Control System 5.8

http://www.cisco.com/c/en/us/support/security/

secure-access-control-system/products-device-support-tables-list.html

Installation and Upgrade Guide for Cisco Secure Access Control System 5.8

http://www.cisco.com/c/en/us/support/security/

secure-access-control-system/products-installation-guides-list.html

Release Notes for Cisco Secure Access Control System 5.8

http://www.cisco.com/c/en/us/support/security/

secure-access-control-system/products-release-notes-list.html

Regulatory Compliance and Safety Information for Cisco Secure Access Control System

http://www.cisco.com/c/en/us/td/docs/net_mgmt/

cisco_secure_access_control_system/5-6/regulatory/compliance/

csacsrcsi.html

Obtaining Documentation and Submitting a Service Request

For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What’s New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:

http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html

Subscribe to the What’s New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS Version 2.0.

Overview

The Cisco Secure Access Control System (ACS) is a policy-based access control system and an integration point for network access control and identity management.

ACS 5.8 provides web services and command-line interface (CLI) commands that allow software developers and system integrators to programmatically access some ACS features and functions. ACS 5.8 also enables you to access to the Monitoring and Report Viewer database that you can use to create custom applications to monitor and troubleshoot ACS.

You can use these web service and CLI commands to:

n Integrate external applications directly with ACS.

n View and modify the information stored in ACS.

The User Change Password (UCP) web service allows users, defined in the ACS internal database, to first authenticate and then change their own password. ACS exposes the UCP web service to allow you to create custom web-based applications that you can deploy in your enterprise.

The Monitoring and Report Viewer web services allow you to create custom applications to track and troubleshoot events in ACS.

ACS REST web services allows you to manage the entities such as users, identity groups, hosts, network devices, network device groups, network device group types, and maximum user sessions on your own management applications and use ACS PI to transfer these entities into ACS. This allows you to define these entities and use them on your own systems and on ACS.

ACS REST web services allows your to change the internal user password through REST API client. For more information on this, see Changing Internal User Password from REST API.

The scripting interface in ACS allows you to perform create, read, update, and delete (CRUD) operations on ACS objects. You can create an automated shell script to perform bulk operations.

ACS allows you to export data from the Monitoring and Report Viewer database. You can use this data to create custom reporting applications. Monitoring and Report Viewer Database Schema in this document contains the Monitoring and Report Viewer database schema to help you create your custom application.

ACS 5.8 provides:

n UCP web service to perform the following operations:

— Authenticate User

— Change User Password

n Monitoring and Report Viewer web services that provide:

— Monitoring and Report Viewer version

— Monitoring and Report Viewer web services version

— Authentication status of a user by date

— Authentication status of a user by time

— A list of records that give the reasons for failures

— A list of RADIUS accounting records

n Configuration web services to perform the following operations:

— Create, read, update and delete objects, including creating and removing any associations to the objects

— Get a list of objects of the same type (For example, a list of all Users)

— Retrieve associated objects, including filtering capabilities

— Execute queries

n CLI commands to perform bulk operations on ACS objects for the following functions:

— Import

— Export

You can perform bulk operations on the following ACS objects—users, hosts, network devices, identity groups, network device groups (NDGs), downloadable access control lists (DACLs), and command sets.

Before you begin to use the ACS web services and CLI commands in scripts, you must have a working knowledge of:

n Web Services Description Language (WSDL) File

n Web Application Description Language (WADL) File

n Web Services Tools

This chapter contains the following sections:

n Understanding Web Services

n Understanding WSDL

Understanding Web Services

Web services are a subset of web-based applications that use the XML protocol to exchange data between the client and the server. Web services use:

n Hypertext Transfer Protocol Secure (HTTPS)—Transports messages between client applications and the web service server.

n Simple Object Access Protocol (SOAP)—Encodes messages in a common XML format so that they can be understood at either end (web service consumer and web service server) of a network connection. SOAP standardizes the format of the requests to the web service server. Any client application can interface with the ACS web server using SOAP over HTTPS.

n WSDL file—Describes the web service, its location, and its operations. ACS 5.8 exposes the following WSDL files:

— UCP WSDL

— Monitoring and Report Viewer WSDL

n Representational State Transfer (REST)—REST is a software architecture style for distributed systems. ACS Configuration web services are built using the REST architecture. This service provides a uniform set of operations for all resources.

RESTful web services typically map the four main HTTP methods; POST, GET, PUT, and DELETE to common operations; that is, create, retrieve, update, and delete, respectively.

n WADL file—Describes the REST interface. This includes description of objects and methods for the REST interface.

Understanding WSDL

The Web Services Description Language (WSDL) is an XML format that describes network services as a collection of ports that operate on messages. WSDL is extensible to allow the description of endpoints and their messages, regardless of the message formats or network protocols that you use.

For more information on WSDL documentation and software downloads, refer to the World Wide Web Consortium website.

You can use any third-party applications to transform your WSDL file.

Understanding WADL

The Web Application Description Language (WADL) file describes REST Interface schema (object structure), HTTP methods, and URLs that are available for each object to invoke REST request.

The WADL files are designed to provide a machine processable description of HTTP based web applications. They are supplemented with XML schema for XML based data formats. ACS also provides XSD files that describe the objects structure. You can generate object classes out of XSD files, using third party tools.

Using the UCP Web Service

This chapter describes the environment that you must set up to use the User Change Password (UCP) web service and explains how you can use it.

The UCP web service allows you to authenticate an internal user and change the internal user password. You can use this web service interface to integrate ACS with your in-house portals and allow users in your organization to change their own passwords.

The UCP web service allows only the users in your organization to change their passwords. They can do so on the primary or secondary ACS servers.

The UCP web service compares the new password that you provide with the password policy that is configured in ACS for users. If the new password conforms to the defined criteria, your new password takes effect. After your password is changed on the primary ACS server, ACS replicates it to all the secondary ACS servers.

The Monitoring and Report Viewer provides a User_Change_Password_Audit report that is available under the ACS Instance catalog. You can generate this report to track all changes made to user passwords in the internal database, including the changes made through the UCP web service. You can use this report to monitor usage and failed authentications.

Now, you can download the UCP.war file from ACS 5.8 and use it in the JBoss 5.1.0.GA application with jdk6.

Enabling the Web Interface on ACS CLI

You must enable the web interface on ACS before you can use the UCP web service. To enable the web interface on ACS, from the ACS CLI, enter:

acs config-web-interface ucp enable

For more information on the acs config-web-interface command, see CLI Reference Guide for Cisco Secure Access Control System 5.8.

Viewing the Status of the Web Interface from ACS CLI

To view the status of the web interface, from the ACS CLI, enter:

show acs-config-web-interface

For more information on the acs config-web-interface command, see CLI Reference Guide for Cisco Secure Access Control System 5.8.

This following sections describe how to use the UCP web service:

n Understanding the Methods in the UCP Web Service

n Using the WSDL File

n Using the Python Scripts

n Using UCP.war File

Understanding the Methods in the UCP Web Service

The UCP web service comprises the following methods:

n User Change Password

User Change Password

The User Change Password method authenticates a user against an internal database and changes the user password.

Input Parameters

n Username

n Current password

n New password

Purpose

Use the changeUserPassword method for applications that require a single-step procedure to change the user password. Changing a user password is normally a two-step procedure. The first step is to authenticate the user and the second step is to change the user password.

The changeUserPassword method allows you to combine the two steps into one. A script or a single-page web application is an example of applications that require a single-step procedure to change the user password.

To change a password:

1. Connect to the UCP web application

A login page appears.

2. Enter the username and password.

The authenticateUser web service function is invoked. If your credentials match the data in the ACS internal store, your authentication succeeds.

The user authentication process does not perform any change and does not authorize you to perform any task. You use this process only to verify if the password is correct.

If authentication succeeds, the web service compares the new password against the password policy that is configured in ACS.

If your new password meets the defined criteria, the changeUserPassword web service function is invoked to change your password.

Output Parameters

The response from the User Change Password method could be one of the following:

n Operation Succeeded

n Operation Failed

Exceptions

This method displays an error if:

n The authentication fails because of an incorrect username or password.

n The user is disabled.

n The password change operation fails because the password does not conform to the password complexity rules defined in ACS.

n A web service connection error occurs, such as network disconnection or request timeout error.

n A system failure occurs, such as the database being down and unavailable.

Using the WSDL File

This section describes the WSDL file and the request and response schemas for the User Authentication and User Change Password methods. This section contains:

n Downloading the WSDL File

n UCP WSDL File

n Request and Response Schemas

Downloading the WSDL File

To download the WSDL file from the ACS 5.8 web interface:

1. Log into the ACS 5.8 web interface.

2. Choose System Administration > Downloads > User Change Password.

3. Click UCP WSDL to view the UCP WSDL file.

4. Copy the WSDL file to your local hard drive.

5. Click UCP web application example to download a sample web application and save it to your local hard drive.

UCP WSDL File

n User Authentication Request

n User Authentication Response

n User Change Password Request

n User Change Password Response

User Authentication Request

<message name="AuthUserRequest">

<part name="user_name" element="changepass:usernameType" />

<part name="password" element="changepass:passwordType" />

</message>

User Authentication Response

<message name="AuthUserResponse">

<part name="authUserResponse" element="changepass:ResponseType" />

</message>

User Change Password Request

<message name="ChangeUserPassRequest">

<part name="user_name" element="changepass:usernameType" />

<part name="current_password" element="changepass:passwordType" />

<part name="new_password" element="changepass:passwordType" />

</message>

User Change Password Response

<message name="ChangeUserPassResponse">

<part name="changeUserPassResponse" element="changepass:ResponseType" />

</message>

Using the Python Scripts

You can create custom web-based applications to enable users to change their own password for your enterprise. This section describes how you can run a sample application that is developed using Python and provides the sample client code.

The ACS web interface provides a downloadable package that consists of:

n Python SOAP libraries for Linux and Windows

n Python script

n ReadMe—Contains installation instructions

To download this package:

1. Log into the ACS 5.8 web interface.

2. Choose System Administration > Downloads > Sample Python Scripts.

The Sample Python Scripts page appears.

3. Click Python Script for Using the User Change Password Web Service.

4. Save the .zip file to your local hard disk.

After installing ACS 5.8 patch 4, you must run the modules packaged in the Downloads option in ACS on RH 7 which has Python 2.7.5 and OpenSSL 1.0.1e that supports TLSv1.2/1.1 to use the python scripts of UCP on the Linux machine.

Sample Client Code shows a sample.zip file. This file contains a .war file. You have to deploy this .war file within a web server, such as Tomcat. This example allows your application to communicate with ACS through the UCP web service.

The Cisco Technical Assistance Center (TAC) supports only the default Python Script. TAC does not offer any support for modified scripts.

Sample Client Code

from SOAPpy import SOAPProxy

# Get the ACS host / IP

host = raw_input('Please enter ACS host name or IP address:\n')

targetUrl = 'https://' + host + '/PI/services/UCP/'

server = SOAPProxy(targetUrl, 'UCP')

# Get the username

username = raw_input('Please enter user name:\n')

# Get the old password

oldPassword = raw_input('Please enter old password:\n')

# Get the new password

newPassword = raw_input('Please enter new password:\n')

# Call the changeUserPassword with the given input

ans = server.changeUserPass(username, oldPassword, newPassword)

# Password changing failed

if ans.status == 'failure':

print '\nFailure:'

# Print all failure reasons

for err in ans.errors:

print err

else:

# Password was changed successfully

print 'Success'

You must have Python software to run this script.

Installing UCP.war in JBoss Server

To deploy UCP.war in the JBoss server, complete the following steps:

1. Ensure that the JAVA_HOME is set correctly. JAVA_HOME is the location where JDK is installed.

2. Download and extract the JBoss 5.1.0.GA from the link http://www.jboss.org/jbossas/downloads/.

3. Start the JBoss server. You need to navigate to <JBOSS_HOME>\bin\ and run the run.bat (for Windows) or run.sh (for Linux) commands from this location to start the JBoss server. Check the command prompt for the clean startup of JBoss server. Contact the JBoss support team if the JBoss server does not start properly.

4. Enter http://<JBOSS_Installed_Server_IP/HOSTNAME>:< PORT_CONFIGURED> in a browser to launch the JBoss server. If the JBoss server does not start properly, then you need to contact the JBoss support team.

5. Stop the JBoss server using <JBOSS_HOME>/bin/shutdown.bat or shutdown.sh command.

6. Login to Cisco Secure ACS and download UCP.war from the path System Administration > Downloads > User Change Password.

7. Place the UCP.war file in the location <JBOSS_HOME>\server\default\deploy of the JBoss server.

8. Start the JBoss server. You need to navigate to <JBOSS_HOME>\bin\ and run the run.bat (for windows) or run.sh (for Linux) commands from this location to start the JBoss server. You need to verify the JBoss server for a clean startup.

9. Ensure that if the UCP directory is present in the location <JBOSS_HOME>\server\default\work\jboss.web\localhost\. If you cannot find the UCP directory, then you need to download the UCP.war again and repeat the steps 7 to 10.

10. In case if you find any errors or exception even after you deploy UCP.war for the second time, you need to collect the logs from the following location <JBOSS_HOME>\server\default\log\ for further analysis.

Using the Monitoring and Report Viewer Web Services

This chapter describes the environment that you must set up to use the web services provided by the Monitoring and Report Viewer component of ACS 5.8. Hereafter this is referred to as Viewer web services. You can use these web services to create custom applications for tracking and troubleshooting ACS events.

The Viewer web services comprise the following methods:

n getVersion()—Returns the version of the Monitoring and Report Viewer server.

n getAuthenticationStatusByDate()—Returns the authentication status of a user by date.

n getAuthenticationStatusByTimeUnit()—Returns the authentication status of a user by time.

n getFailureReasons()—Returns a list of reasons for failure.

n getRadiusAccounting()—Returns a list of RADIUS accounting records.

n getAPIVersion()—Returns the version of the Viewer web services.

Enabling the Web Interface on ACS CLI

You must enable the web interface on ACS before you can use the Viewer web services. To enable the web interface on ACS, from the ACS CLI, enter:

acs config web-interface view enable

For more information on the acs config-web-interface command, see CLI Reference Guide for Cisco Secure Access Control System 5.8.

Viewing the Status of the Web Interface from ACS CLI

To view the status of the web interface, from the ACS CLI, enter:

show acs-config-web-interface

For more information on the acs config-web-interface command, see CLI Reference Guide for Cisco Secure Access Control System 5.8.

The following sections describe how to use the Monitoring and Report Viewer web services:

n Understanding the Methods in the Viewer Web Services

n Understanding the WSDL Files

n Integrating the Viewer Web Services with Your Application

n Working with the Viewer Web Services

Understanding the Methods in the Viewer Web Services

This section describes the methods that are available in the Viewer web services:

n Get Version

n Get Authentication Status By Date

n Get Authentication Status By Time Unit

n Get Failure Reasons

n Get RADIUS Accounting

n Get API Version

Table 1 describes the classes that are used in the Viewer web services.

Table 1 Viewer Web Services Class Information

Class

Description

ACSViewWebServices

Contains all web services that a client views in the client applications.

UserContext

Contains the ACS username and the user password, which the Monitoring and Report Viewer server uses to authenticate the user.

AuthenticationParam

Encapsulates the authentication query parameters, based on which records are queried and returned to you.

AuthenticationStatus

Contains the Authentication Status record that is the query output received from ACS.

AccountingParam

Encapsulates the accounting query parameters, based on which records are queried and returned to you.

AccountingStatus

Contains the Accounting Status record that is the query output received from ACS.

AccountingDetail

Contains a list of attribute values that comprise the query output received from ACS.

ACSViewNBException

Contains the errors that the Monitoring and Report Viewer displays for any issues with the web services.

The Monitoring and Report Viewer places all web service classes in the com.cisco.acsview.nbapi package.

Get Version

Input Parameter

userCtx—(Required) User context object

Purpose

Use the getVersion method to view the version of the Monitoring and Report Viewer that is installed on your ACS server. You can enter this command in the CLI to call this web service to view the Monitoring and Report Viewer version.

Output Parameters

Version of the Monitoring and Report Viewer server.

Exception

This method displays an error if:

n The user is invalid

n The input is invalid

n The ACS instance is not running as the Monitoring and Report Viewer server

Get Authentication Status By Date

Input Parameters

n userCtx—(Required) User context object

n authParam—(Required) AuthenticationParam object

n startDate—(Required) The date from which you want the authentication status

n endDate—(Required) The date until which you want the authentication status

Purpose

Use the getAuthenticationStatusByDate method to view a user’s authentication status, arranged chronologically by date, for a specific period.

Output Parameter

Authentication status of the user, arranged chronologically by date, for the specified period.

Exception

This method displays an error if the:

n User context value is entered but passed as null

n Username and password are entered but passed as null

n Date value is entered but passed as null

Get Authentication Status By Time Unit

Input Parameters

n userCtx—(Required) User context object

n authParam—(Required) AuthenticationParam object

n lastX—(Required) The time until which you need the authentication status

n timeUnit—(Required) Time unit, specified in minutes, hours, or days

Purpose

Use the getAuthenticationStatusByTimeUnit method to view a user’s authentication status, arranged chronologically by time, for a specific period.

Output Parameter

A list of the user’s authentication status, arranged chronologically by time, for a specific period.

Exception

This method displays an error if the:

n User context value is entered but passed as null

n Username and password are entered but passed as null

n Date value is entered but passed as null

Get Failure Reasons

Input Parameter

userCtx—(Required) User context object

Purpose

Use the getFailureReasons method to obtain a list of records that contain failure reasons.

Output Parameters

List of records that contain failure reasons.

Exception

This method displays an error if the user credentials are invalid.

Get RADIUS Accounting

Input Parameters

n userCtx—(Required) User context object

n acctParam—(Required) Accounting search parameters; valid values for matchOperator are valueLIKE, valueEQ, valueNE, valueGE, valueLE, valueGT, valueLT, attrEQ, valueIN, valueINNOT. The equation takes any one of the following forms:

— AttributeName, MatchArgument, MatchOp=[ valueLIKE | valueEQ | valueNE | valueGE | valueLE | valueGT | valueLT | attrEQ]

— AttributeName, MultipleValueMatchArgument, MatchOp=[ valueIN | valueINNOT ]

Attribute Name—As defined by standard RADIUS/Cisco A-V pair names. Attribute names are not case sensitive. However, the values are case sensitive.

valueLIKE—Looks for wildcard match (%). For example, %foo%.

valueEQ—Looks for an exact match.

valueNE—Performs a value not equal to comparison.

valueGE—Performs greater than or equal to comparison.

valueLE—Performs lesser than or equal to comparison.

valueGT—Performs a greater than comparison.

valueLT—Performs a lesser than comparison.

attrEQ—Compares a given attribute with another attribute; returns true or false.

valueIN—Multiple values are allowed for matchOperator valueIN.

valueINNOT—Multiple values are not allowed for matchOperator valueINNOT.

n returnAttributes—(Required) List of return attributes requested.

n startDate—(Required) Date from which you want the RADIUS accounting records.

n endDate—(Required) Date until which you want the RADIUS accounting records.

Purpose

Use the getRADIUSAccounting method to obtain a list of RADIUS accounting records.

Output Parameters

List of RADIUS accounting records.

Exception

This method displays an error if:

n User credentials are invalid

n The acctParam parameter contains invalid values for matchOperator

n The acctParam parameter contains invalid value for matchValues

n A database select error occurs

Get API Version

Input Parameter

userCtx—(Required) User context object

Purpose

Use the getAPIVersion method to obtain the version of the Viewer web services.

Output Parameter

Version of the Viewer web services.

Exception

This method displays an error if an authentication failure occurs.

Understanding the WSDL Files

This section describes the WSDL files, the location from which you can download them, the class files, and the queries that you can use in the Viewer web services. This section contains the following:

n Downloading the WSDL Files

n Viewer WSDL Files

n Integrating the Viewer Web Services with Your Application

Downloading the WSDL Files

You can download the WSDL files from the following location:

https://ip address or hostname/ACSViewWebServices/ACSViewWebServices?wsdl, where ip address or hostname is the IP address or hostname of your ACS server.

Viewer WSDL Files

WSDL is an XML document that describes a web service, the location of the service, and operations that the service exposes:

<definitions name="ACSViewWebServicesService" targetNamespace="http://nbapi.acsview.cisco.com/jaws" xmlns="http://schemas.xmlsoap.org/wsdl/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:tns="http://nbapi.acsview.cisco.com/jaws" xmlns:xsd="http://www.w3.org/2001/XMLSchema">

<types>

<schema elementFormDefault="qualified" targetNamespace="http://nbapi.acsview.cisco.com/jaws" xmlns="http://www.w3.org/2001/XMLSchema" xmlns:soap11-enc="http://schemas.xmlsoap.org/soap/encoding/" xmlns:tns="http://nbapi.acsview.cisco.com/jaws" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

<complexType name="getFailureReasons">

<sequence>

<element name="userCtx" nillable="true" type="tns:UserContext"/>

</sequence>

</complexType>

<complexType name="getAuthenticationStatusByDate">

<sequence>

<element name="userCtx" nillable="true" type="tns:UserContext"/>

<element name="authParam" nillable="true" type="tns:AuthenticationParam"/>

<element name="startDate" nillable="true" type="dateTime"/>

<element name="endDate" nillable="true" type="dateTime"/>

</sequence>

</complexType>

<complexType name="getAuthenticationStatusByDateResponse">

<sequence>

<element maxOccurs="unbounded" minOccurs="0" name="result" nillable="true" type="tns:AuthenticationStatus"/>

</sequence>

</complexType>

<complexType name="getAuthenticationStatusByTimeUnit">

<sequence>

<element name="userCtx" nillable="true" type="tns:UserContext"/>

<element name="authParam1" nillable="true" type="tns:AuthenticationParam"/>

<element name="lastX" type="int"/>

<element name="timeUnit" nillable="true" type="string"/>

</sequence>

</complexType>

<complexType name="getVersion">

<sequence>

<element name="userCtx" nillable="true" type="tns:UserContext"/>

</sequence>

</complexType>

<complexType name="ACSViewNBException">

<sequence>

<element name="message" nillable="true" type="string"/>

</sequence>

</complexType>

<complexType name="FailureReason">

<sequence>

<element name="authenFailureCode" nillable="true" type="string"/>

<element name="possibleRootCause" nillable="true" type="string"/>

<element name="resolution" nillable="true" type="string"/>

</sequence>

</complexType>

<complexType name="AuthenticationParam">

<sequence>

<element name="AAAClient" nillable="true" type="string"/>

<element name="clientIPAddress" nillable="true" type="string"/>

<element name="clientMACAddress" nillable="true" type="string"/>

<element name="userName" nillable="true" type="string"/>

</sequence>

</complexType>

<complexType name="AuthenticationStatus">

<sequence>

<element name="authStatus" nillable="true" type="string"/>

<element name="date" nillable="true" type="dateTime"/>

<element name="errorCode" nillable="true" type="string"/>

<element maxOccurs="unbounded" minOccurs="0" name="moreDetails" nillable="true" type="string"/>

</sequence>

</complexType>

<complexType name="getAuthenticationStatusByTimeUnitResponse">

<sequence>

<element maxOccurs="unbounded" minOccurs="0" name="result" nillable="true" type="tns:AuthenticationStatus"/>

</sequence>

</complexType>

<complexType name="getVersionResponse">

<sequence>

<element name="result" nillable="true" type="string"/>

</sequence>

</complexType>

<complexType name="getFailureReasonsResponse">

<sequence>

<element maxOccurs="unbounded" minOccurs="0" name="result" nillable="true" type="tns:FailureReason"/>

</sequence>

</complexType>

<complexType name="UserContext">

<sequence>

<element name="password" nillable="true" type="string"/>

<element name="userName" nillable="true" type="string"/>

</sequence>

</complexType>

<element name="getAuthenticationStatusByDate" type="tns:getAuthenticationStatusByDate"/>

<element name="getAuthenticationStatusByDateResponse" type="tns:getAuthenticationStatusByDateResponse"/>

<element name="getAuthenticationStatusByTimeUnit" type="tns:getAuthenticationStatusByTimeUnit"/>

<element name="getAuthenticationStatusByTimeUnitResponse" type="tns:getAuthenticationStatusByTimeUnitResponse"/>

<element name="getVersion" type="tns:getVersion"/>

<element name="ACSViewNBException" type="tns:ACSViewNBException"/>

<element name="getVersionResponse" type="tns:getVersionResponse"/>

<element name="getFailureReasons" type="tns:getFailureReasons"/>

<element name="getFailureReasonsResponse" type="tns:getFailureReasonsResponse"/>

</schema>

</types>

<message name="ACSViewNBException">

<part element="tns:ACSViewNBException" name="ACSViewNBException"/>

</message>

<message name="ACSViewWebServices_getAuthenticationStatusByDate">

<part element="tns:getAuthenticationStatusByDate" name="parameters"/>

</message>

<message name="ACSViewWebServices_getAuthenticationStatusByTimeUnitResponse">

<part element="tns:getAuthenticationStatusByTimeUnitResponse" name="result"/>

</message>

<message name="ACSViewWebServices_getAuthenticationStatusByDateResponse">

<part element="tns:getAuthenticationStatusByDateResponse" name="result"/>

</message>

<message name="ACSViewWebServices_getVersionResponse">

<part element="tns:getVersionResponse" name="result"/>

</message>

<message name="ACSViewWebServices_getAuthenticationStatusByTimeUnit">

<part element="tns:getAuthenticationStatusByTimeUnit" name="parameters"/>

</message>

<message name="ACSViewWebServices_getVersion">

<part element="tns:getVersion" name="parameters"/>

</message>

<message name="ACSViewWebServices_getFailureReasons">

<part element="tns:getFailureReasons" name="parameters"/>

</message>

<message name="ACSViewWebServices_getFailureReasonsResponse">

<part element="tns:getFailureReasonsResponse" name="result"/>

</message>

<portType name="ACSViewWebServices">

<operation name="getAuthenticationStatusByDate">

<input message="tns:ACSViewWebServices_getAuthenticationStatusByDate"/>

<output message="tns:ACSViewWebServices_getAuthenticationStatusByDateResponse"/>

<fault message="tns:ACSViewNBException" name="ACSViewNBException"/>

</operation>

<operation name="getAuthenticationStatusByTimeUnit">

<input message="tns:ACSViewWebServices_getAuthenticationStatusByTimeUnit"/>

<output message="tns:ACSViewWebServices_getAuthenticationStatusByTimeUnitResponse"/>

<fault message="tns:ACSViewNBException" name="ACSViewNBException"/>

</operation>

<operation name="getVersion">

<input message="tns:ACSViewWebServices_getVersion"/>

<output message="tns:ACSViewWebServices_getVersionResponse"/>

<fault message="tns:ACSViewNBException" name="ACSViewNBException"/>

</operation>

<operation name="getFailureReasons">

<input message="tns:ACSViewWebServices_getFailureReasons"/>

<output message="tns:ACSViewWebServices_getFailureReasonsResponse"/>

<fault message="tns:ACSViewNBException" name="ACSViewNBException"/>

</operation>

</portType>

<binding name="ACSViewWebServicesBinding" type="tns:ACSViewWebServices">

<soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>

<operation name="getAuthenticationStatusByDate">

<soap:operation soapAction=""/>

<input>

<soap:body use="literal"/>

</input>

<output>

<soap:body use="literal"/>

</output>

<fault name="ACSViewNBException">

<soap:fault name="ACSViewNBException" use="literal"/>

</fault>

</operation>

<operation name="getAuthenticationStatusByTimeUnit">

<soap:operation soapAction=""/>

<input>

<soap:body use="literal"/>

</input>

<output>

<soap:body use="literal"/>

</output>

<fault name="ACSViewNBException">

<soap:fault name="ACSViewNBException" use="literal"/>

</fault>

</operation>

<operation name="getVersion">

<soap:operation soapAction=""/>

<input>

<soap:body use="literal"/>

</input>

<output>

<soap:body use="literal"/>

</output>

<fault name="ACSViewNBException">

<soap:fault name="ACSViewNBException" use="literal"/>

</fault>

</operation>

<operation name="getFailureReasons">

<soap:operation soapAction=""/>

<input>

<soap:body use="literal"/>

</input>

<output>

<soap:body use="literal"/>

</output>

<fault name="ACSViewNBException">

<soap:fault name="ACSViewNBException" use="literal"/>

</fault>

</operation>

</binding>

<service name="ACSViewWebServicesService">

<port binding="tns:ACSViewWebServicesBinding" name="ACSViewWebServices">

<soap:address location="http://localhost:8080/ACSViewWebServices/ACSViewWebServices"/>

</port>

</service>

</definitions>

Integrating the Viewer Web Services with Your Application

This section explains how to integrate the Viewer web services with your application.

To integrate your code with a Viewer web service and to ensure that you get a response after you invoke the web service:

1. Obtain the certificate from the server to create the client certificate:

a. Verify the deployed web services from:

https://ip address or hostname/ACSViewWebServices/ACSViewWebServices?wsdl

For more information on the web services, see Understanding the Methods in the Viewer Web Services.

b. Click View Certificate and go to the Details tab.

c. Click Copy to File.

d. In the welcome window, click Next.

e. In the Export File Format window, select DER encoded binary X.509(.CER), then click Next.

f. In the File to Export window, enter the filename and click Next.

g. In the Completing the Certificate Export Wizard window, click Finish.

A copy of the certificate is saved in your local system as server.cer.

h. Import the server certificate and store it as client.ks (the Client Certificate) using the following command:

keytool -import -file server.cer -keystore client.ks

2. Verify the deployed Viewer web services from:

https://IPaddress(or)HostName/ACSViewWebServices/ACSViewWebServices?wsdl

For more information on the web services, see Understanding the Methods in the Viewer Web Services.

3. View the source and copy the WSDL file to your local system using:

soap:address location='https://acsview-cars1:443/ACSViewWebServices/ACSViewWebServices'/

For more information on the WSDL files, see Understanding the WSDL Files.

4. Download the JAX-WS 2.0 libraries from the Sun Microsystems website.

5. To view the information related to your artifacts, enter the wsimport -keep command at: https://IPAddress:443/ACSViewWebServ/ACSViewWebServices?wsdl

Include all the libraries in your location.

6. Write the client code.

7. Compile and run the client code.

Working with the Viewer Web Services

This section provides sample client code in Java. The requirements that this section describes apply only if you use Java as the client-side conversion tool. This section contains:

n Required Files

n Supported SOAP Clients

n Sample Client Code

Required Files

To use Java (JAX-WS) 2.0 as the client-side conversion tool, you need the following JAR files. You can download the .jar files and the related tools from the Sun Microsystems website:

n activation.jar

n FastInfoset.jar

n http.jar

n jaxb-api.jar

n jaxb-impl.jar

n jaxb-xjc.jar

n jaxws-api.jar

n jaxws-rt.jar

n jaxws-tools.jar

n jsr173_api.jar

n jsr181-api.jar

n jsr250-api.jar

n resolver.jar

n saaj-api.jar

n saaj-impl.jar

n sjsxp.jar

Supported SOAP Clients

The supported SOAP clients include:

n Apache

n JAX-WS

Connecting to the Viewer Web Services

To connect to the Viewer Web Services:

1. Verify the deployed Viewer Web Services from:

https://ip address or hostname/ACSViewWebServices/ACSViewWebServices?wsdl

For more information on the web services, see Understanding the Methods in the Viewer Web Services.

2. Right click and select View Source/View Page Source option to view the source information.

The source information appears in a pop-up dialog box.

3. Save the source information with the name ACSViewWebServices.wsdl on your local directory; <SERVICE_HOME>.

4. Execute the following command to create the class files:

wsimport <SERVICE_HOME>/ACSViewWebServices.wsdl -d <SERVICE_HOME>

5. Copy the Sample Client Code and save it as Client.java in <SERVICE_HOME> and compile it with the following command

javac -cp <SERVICE_HOME> <SERVICE_HOME>/Client.java -d <SERVICE_HOME>

This compiles the client code and places the package in the <SERVICE_HOME> directory.

6. To run the Client code, execute the following command

java -cp <SERVICE_HOME> com.cisco.acsview.nbapi.jaws.Client.

The above mentioned steps are done in Java 1.6.0_25. JAVA_HOME is java installed directory, and the “path” environment variable should be added with the value <JAVA_HOME>/bin.

Sample Client Code

This section provides sample client code for the Viewer web services.

package com.cisco.acsview.nbapi.jaws;

import java.util.Calendar;

import java.util.GregorianCalendar;

import java.util.ArrayList;

import java.util.List;

import java.util.Iterator;

import com.sun.org.apache.xerces.internal.jaxp.datatype.XMLGregorianCalendarImpl;

import javax.xml.datatype.XMLGregorianCalendar;

import javax.xml.datatype.DatatypeFactory;

import java.security.cert.X509Certificate;

import javax.net.ssl.HostnameVerifier;

import javax.net.ssl.HttpsURLConnection;

import javax.net.ssl.SSLContext;

import javax.net.ssl.SSLSession;

import javax.net.ssl.TrustManager;

import javax.net.ssl.X509TrustManager;

public class Client

{

private static void install() throws Exception

{

// Create a trust manager that does not validate certificate chains

TrustManager[] trustAllCerts = new TrustManager[]

{

new X509TrustManager()

{

public X509Certificate[] getAcceptedIssuers()

{

return null;

}

public void checkClientTrusted(X509Certificate[] certs, String authType)

{

// Trust always

}

public void checkServerTrusted(X509Certificate[] certs, String authType)

{

// Trust always

}

}

};

// Install the all-trusting trust manager

SSLContext sc = SSLContext.getInstance("SSL");

// Create empty HostnameVerifier

HostnameVerifier hv = new HostnameVerifier()

{

public boolean verify(String arg0, SSLSession arg1)

{

return true;

}

};

sc.init(null, trustAllCerts, new java.security.SecureRandom());

HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());

HttpsURLConnection.setDefaultHostnameVerifier(hv);

}

public static void install1() throws Exception

{

// Bypass hostname verification.

HttpsURLConnection.setDefaultHostnameVerifier(

new HostnameVerifier()

{

public boolean verify(String arg0, SSLSession arg1)

{

return true;

}

});

}

public static void main(String args[])

{

try

{

install();

ACSViewWebServicesService serviceObj = new ACSViewWebServicesService();

ACSViewWebServices service = serviceObj.getACSViewWebServices();

UserContext userCtx = new UserContext();

userCtx.setUserName("acsadmin");

userCtx.setPassword("Acs5.8");

getVersion(service,userCtx);

getAPIVersion(service,userCtx);

getAuthBydate(service,userCtx);

getAuthByTime(service,userCtx);

getRadiusAccounting(service,userCtx);

getFailureReasons(service,userCtx);

}

catch (Exception ex)

{

ex.printStackTrace();

}

}

/**

* getVersion provide the application version

*/

public static void getVersion(ACSViewWebServices service, UserContext userCtx)

{

try

{

String result = service.getVersion(userCtx);

System.out.println("-------------------------*** Application Version

***-------------------------"+"\n");

System.out.println("Application Version : "+result);

System.out.println("-----------------------------------------------------------------------------"+"\n");

}

catch(Exception e)

{

e.printStackTrace();

}

}

/**

*getAuthByDate provides the data of the authentication success/failure between

the specified date range

*/

private static void getAuthBydate(ACSViewWebServices service, UserContext userCtx)

{

try

{

System.out.println("-------------------------*** Authentication Status by

Date Starts ***-------------------------"+"\n");

AuthenticationParam authParam = new AuthenticationParam();

/**

*** The following Attributes are optional.

** If the parameters are not set, method will return all the authentications

success/failure between the specified date range.

** The Data will be filtered based on the attribute set which is falling

under the specified date range.

** The attributes set are exactly matched for filtering,ie., only the data

which is matching the below attributes

and with in the specified date range are retrived.

*/

authParam.setAAAClient("MyClient");

authParam.setClientIPAddress("10.77.241.203");

authParam.setClientMACAddress("ABAC00019E05");

authParam.setUserName("user1");

/******* Optional Attributes Ends **************/

DatatypeFactory datatypeFactory = DatatypeFactory.newInstance();

GregorianCalendar gc1 = newGregorianCalendar(2011, Calendar.AUGUST, 4);

XMLGregorianCalendar startDate =

datatypeFactory.newXMLGregorianCalendar(gc1).normalize();

GregorianCalendar gc2 = newGregorianCalendar(2011, Calendar.AUGUST, 6);

XMLGregorianCalendar endDate =

datatypeFactory.newXMLGregorianCalendar(gc2).normalize();

java.util.List authStatusArray =

service.getAuthenticationStatusByDate(userCtx,authParam, startDate, endDate);

System.out.println("No of Records Retrieved : "+authStatusArray.size());

for(int i=0; i<authStatusArray.size();i++)

{

System.out.println("*************** Authentication Status : "+(i+1)+"

***************");

AuthenticationStatus status = (AuthenticationStatus)authStatusArray.get(i);

java.util.List sarray = status.getMoreDetails();

System.out.println(sarray.get(0) +" :: "+sarray.get(1));

for(int j=0;j<sarray.size();j++)

{

System.out.println(sarray.get(j)+" :: "+sarray.get(++j));

}

System.out.println("******************************************************************");

}

System.out.println("-------------------------*** Authentication Status by

Date Ends ***-------------------------"+"\n");

}

catch (Exception ex)

{

ex.printStackTrace();

}

}

/**

* getAuthByTime provides the data of the authentication success/failure in the

specified time.

* Time can be provided in Minutes, Hours or Days

*/

private static void getAuthByTime(ACSViewWebServices service, UserContext userCtx)

{

try

{

System.out.println("-------------------------*** Authentication Status by

Time Starts ***-------------------------"+"\n");

AuthenticationParam authParam = new AuthenticationParam();

/**

*** The following Attributes are optional.

** If the parameters are not set method will return all the authentications

success/failure between the specified date range.

** The Data will be filtered based on the attribute set which is falling

under the specified date range.

** The attributes set are exactly matched for filtering,ie., only the data

which is matching the below attributes

and with in the specified date range are retrived.

*/

authParam.setAAAClient("MyClient");

authParam.setClientIPAddress("10.77.241.203");

authParam.setClientMACAddress("ABAC00019E05");

authParam.setUserName("user1");

/******* Optional Attributes Ends **************/

java.util.List authStatusArray =

service.getAuthenticationStatusByTimeUnit(userCtx,authParam, 20, "Hours");

System.out.println("No of Records Retrieved : " + authStatusArray.size());

for(int i=0; i<authStatusArray.size();i++)

{

System.out.println("*************** Authentication Status : "+(i+1)+"

***************");

AuthenticationStatus status = (AuthenticationStatus)authStatusArray.get(i);

java.util.List sarray = status.getMoreDetails();

System.out.println(sarray.get(0) +" :: "+sarray.get(1));

for(int j=0;j<sarray.size();j++)

{

System.out.println(sarray.get(j)+" :: "+sarray.get(++j));

}

System.out.println("******************************************************************");

}

System.out.println("-------------------------*** Authentication Status by

Time Ends ***-------------------------"+"\n");

}

catch (Exception ex)

{

ex.printStackTrace();

}

}

/**

** getAPIVersion provides the application API Version

*/

public static void getAPIVersion(ACSViewWebServices service, UserContext userCtx)

{

try

{

System.out.println("-------------------------*** API Version

***-------------------------"+"\n");

String apiresult = service.getAPIVersion(userCtx);

System.out.println("API Version : "+apiresult);

System.out.println("-----------------------------------------------------------------------------"+"\n");

}

catch(Exception ex)

{

ex.printStackTrace();

}

}

/**

** getFailureReasons provide the Failure Code, Possible Root Cause and Resolution

*/

public static void getFailureReasons(ACSViewWebServices service, UserContext

userCtx)

{

try

{

// Get Failure reason - Example

System.out.println("-------------------------*** Failure Reasons Starts

***-------------------------"+"\n");

List result1 = service.getFailureReasons(userCtx);

System.out.println("Failure reasons list is : " + result1.size());

for (int i=0;i<result1.size() ;i++ )

{

System.out.println("Authentication Failure Code :

"+((FailureReason)result1.get(i)).getAuthenFailureCode());

System.out.println("Possible Root Cause :

"+((FailureReason)result1.get(i)).getPossibleRootCause());

System.out.println("Resolution :

"+((FailureReason)result1.get(i)).getResolution());

}

System.out.println("-------------------------*** Failure Reasons Ends

***-------------------------"+"\n");

}

catch(Exception ex)

{

ex.printStackTrace();

}

}

/**

** getRadiusAccounting provides the accounting details between the specified

date range.

*/

public static void getRadiusAccounting(ACSViewWebServices service, UserContext

userCtx)

{

try

{

System.out.println("-------------------------*** Radius Accounting Starts

***-------------------------"+"\n");

List acctParam = new ArrayList();

AccountingParam acParam = new AccountingParam();

List valList = acParam.getMatchValues();

valList.add("11");

acParam.setAttributeName("cisco-h323-disconnect-cause/h323-disconnect-cause");

acParam.setMatchOperator("valueINNOT");

acctParam.add(acParam);

List returnAttributes = new ArrayList();

returnAttributes.add("cisco-h323-disconnect-cause/h323-disconnect-cause");

DatatypeFactory datatypeFactory = DatatypeFactory.newInstance();

GregorianCalendar gc1 = newGregorianCalendar(2011, Calendar.AUGUST, 5);

XMLGregorianCalendar startDate =

datatypeFactory.newXMLGregorianCalendar(gc1).normalize();

GregorianCalendar gc2 = newGregorianCalendar(2011, Calendar.AUGUST, 7);

XMLGregorianCalendar endDate =

datatypeFactory.newXMLGregorianCalendar(gc2).normalize();

AccountingStatus acctStatus = service.getRadiusAccounting(userCtx,acctParam,

startDate, endDate, returnAttributes);

List attrNames = acctStatus.getAttrNames();

for(int x=0 ; x<attrNames.size() ; x++)

{

System.out.println("Attribute Names : "+attrNames.get(x));

}

List acctDetailsList = (ArrayList)acctStatus.getAcctDetails();

Iterator detailIterator = acctDetailsList.iterator();

while(detailIterator.hasNext())

{

AccountingDetail acctDetailObj = (AccountingDetail)detailIterator.next();

List acctDetails = (List)acctDetailObj.getAttrValues();

for (int i=0;i<acctDetails.size() ;i++ )

{

System.out.println("Attribute Details : "+acctDetails.get(i));

}

}

System.out.println("-------------------------*** Radius Accounting Ends

***-------------------------"+"\n");

}

catch(Exception e)

{

e.printStackTrace();

}

}

}

Using the Configuration Web Services

This chapter describes the environment that you must set up to use the Configuration web service and explains how to use it.

The Configuration web services are implemented as REST interfaces over HTTPS. There is no HTTP support.

Configuring REST web services are available on all ACS servers in the deployment, but only the ACS primary instance provides the full service that supports read and write operations. Secondary ACS instances provide read only access to the configuration data.

The Monitoring and Report Viewer displays the messages and audit logs for all REST activities.

Enabling the REST Web Interface on ACS CLI

You must enable the web interface on ACS before you can use the REST web service. To enable the web interface on ACS, from the ACS CLI, enter:

acs config-web-interface rest enable

For more information on the acs config-web-interface command, see CLI Reference Guide for Cisco Secure Access Control System 5.8.

Viewing the Status of the REST Web Interface from ACS CLI

To view the status of the web interface, from the ACS CLI, enter:

show acs-config-web-interface

For more information on the acs config-web-interface command, see CLI Reference Guide for Cisco Secure Access Control System 5.8.

Applications that interact with the ACS configuration REST service may use any administrator account to authenticate to the REST service. Authorization for the used account should be set to allow all activities that are done by the REST client.

Supported Configuration Objects

The Rest PI in ACS provides services for configuring ACS, and it is organized for each configuration feature. In ACS 5.8, the following five subsets of the ACS configuration are supported:

n Common configuration objects

n Users configuration objects, Hosts configuration objects, and Identity group configuration objects.

n Network Device configuration objects

n Device Group configuration objects

n Device Group Type configuration objects

n Maximum User Sessions

Table 1 Supported Configuration Objects

Feature

Main Supported Classes

Comments

Common

Attribute Info

Also known as dynamic attributes or AV pair. Attribute Info is composed within Protocol User.

ACS Version

Supports Get method only.

Service Location

Supports getall method only.

It allows you to find the ACS instance that serve as primary and the ACS instance that provide Monitoring and Troubleshooting Viewer.

Error Message

Supports getall method only.

It allows you to retrieve all ACS message codes and message texts that are used on the REST Interface.

Identity

Protocol User

Full CRUD (Create, Read, Update, and Delete) and query support.

Identity Group

Full CRUD and query support.

Query is used to retrieve subgroups of a specific node. The list of users for each group is fetched by querying on the users.

Internal Host

Full CRUD and query support.

Network Device

Network Device

Full CRUD and query support.

Device Group

Network Device Group

Full CRUD and query support.

Device Group Type

Network Device Group Type

Full CRUD and query support.

This section contains:

n Identity Groups

n Attribute Info

n Group Associations

n Device Info

Identity Groups

The Identity Group object is used to manipulate nodes on the Identity Group hierarchy. The group name defines the full path of the node within the hierarchy. When you add a new node, you should be aware that the name of the node (which includes the full path) specifies where in the hierarchy the node should be attached. For example:

n All Groups:CDO:PMBU

n All Groups:CDO

n All Groups:CDO:PMBU:ACS-Dev

In order to retrieve the child of a certain group, you can set a filter as “start” with All groups:CDO”.

Attribute Info

The AttributeInfo structure is an array of pairs of attribute names and attribute values.

The attribute name refers to the user dictionary, where the definition of the attribute, such as value type, can be found. The value of the attribute must conform with the dictionary definition.

The following is an example of JAVA representation for a user that has two attributes:

User user = new User();

user.setDescription(description);

user.setPassword(password);

user.setName(userName);

user.setAttributeInfo(new AttributeInfo[]{

new AttributeInfo("Department","Dev"),

new AttributeInfo("Clock","10 Nov 2008 12:12:34")

});

Group Associations

The REST Interface schema shows the association of the user to the Identity group, as a group name property on the user object.

Here is an example of associating a user to an identity group:

User user = new User();

user.setIdenityGroupName("IdentityGroup:All Groups:Foo");

user.setDescription(description);

user.setPassword(password);

user.setName(userName);

Device Info

It is mandatory to provide information about at least one group to which the network device is associated while updating a network device using the REST interface. The network device may be associated with more than one group. The group information that is not provided will automatically be updated with a default value.

Query Object

The REST Interface schema exposes a query object to define criteria and other query parameters. The query object is used for Users, Identity Groups, Network Device, Network Device Groups, Internal Hosts, and Maximum User Sessions.

The query object includes parameters that apply to:

n Filtering

n Sorting

n Paging

Filtering

You can use the query object to retrieve a filtered result set. You can filter users or identity groups, based on the following criteria:

n Simple condition—Includes property name, operation, and value. For example, name STARTS_WITH "A".

The following operations are supported for filtering:

— CONTAINS

— DOES_NOT_CONTAIN

— ENDS_WITH

— IS_EMPTY

— EQUALS

— NOT_EMPTY

— NOT_EQUALS

— STARTS_WITH

n And condition— Includes set of simple conditions. All simple condition must be evaluated to be True in order for the and condition to be matched.

Here is an XML-based example for the “And” filter.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<ns2:query xmlns:ns2="query.rest.mgmt.acs.nm.cisco.com">

<criteria xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:type="ns2:AndFilter">

<simpleFilters>

<propertyName>name</propertyName>

<operation>STARTS_WITH</operation>

<value>user</value>

</simpleFilters>

<simpleFilters>

<propertyName>name</propertyName>

<operation>ENDS_WITH</operation>

<value>1</value>

</simpleFilters>

</criteria>

<numberOfItemsInPage>100</numberOfItemsInPage>

<startPageNumber>1</startPageNumber>

</ns2:query>

(from upper case "O" to lower case "o") in patch 3. You need to install patch 3 to get this change reflected in ACS.

Here is a Java-based example for the “And” filter:

Query query = new Query();

query.setStartPageNumber(1);

query.setNumberOfItemsInPage(100);

SimpleFilter simpleFilter = new SimpleFilter();

simpleFilter.setOperation(FilterOperation.STARTS_WITH);

simpleFilter.setPropertyName("name");

simpleFilter.setValue("user");

SimpleFilter simpleFilter1 = new SimpleFilter();

simpleFilter1.setOperation(FilterOperation.ENDS_WITH);

simpleFilter1.setPropertyName("name");

simpleFilter1.setValue("1");

AndFilter andFilter = new AndFilter();

andFilter.setSimpleFilters(new SimpleFilter[] { simpleFilter,

simpleFilter1 });

query.setCriteria(andFilter);

Sorting

You can use the query object to sort the results. You can sort based on the following criteria:

n One property to sort by

n Direction of sorting (Ascending/Descending)

Paging

You can set the query object with the following paging parameters:

n Page number, which is the requested page

n Number of objects in a page

Paging is stateless. That is, the required page is calculated from scratch for every request. This means that paging could skip objects or return them twice, in case objects were added or deleted concurrently.

Request Structure

ACS REST request is composed of:

n URL

n HTTP method

n Content—Includes ACS objects if applicable to the requested method. The ACS objects are represented in XML.

URL Path

URL includes:

n Service name: Rest

n Package name: Identity, Common, or Network Device

n Object Type: User, Identity Group, and so on

n Object Identifiers are valid with the GET and DELETE methods.

n Operation name is required for operations other than CRUD, such as query.

Table 2 lists the URLs for each object.

Object Identifiers

Objects are identified by name or by object ID. The basic object key is the object name. You can also use the Object ID for the GET and DELETE methods. For POST and PUT, the method gets the object itself, which includes the identifiers.

You can specify the identifier on the URL in the following ways:

n Name as the key: Rest/{package}/{ObjectType}/name/{name}

n Object ID as the key: Rest//{package}/{ObjectType}/id/{id}

Table 2 URL Summary Table

Object

URL

Comment

ACS Version

../Rest/Common/AcsVersion

Single object exists

Service Location

../Rest/Common/ServiceLocation

—

Error Message

../Rest/Common/ErrorMessage

—

User

../Rest/Identity/User/…..

For some methods, there is additional data on the URL. See Table 3

Identity Group

../Rest/Identity/IdentityGroup/…..

For some methods, there is additional data on the URL. See Table 3

Network Device

../Rest/NetworkDevice/Device/.....

For some methods, there is additional data on the URL. See Table 3

Device Group

..Rest/NetworkDevice/DeviceGroup/.....

For some methods, there is additional data on the URL. See Table 3

Internal Host

../Rest/Identity/Host/.....

For some methods, there is additional data on the URL. See Table 3

HTTP Methods

HTTP methods are mapped to configuration operations (CRUD - Create, Read, Update, and Delete).

The common intrinsic methods are not specified within the URL, and are determined by the HTTP request method. In other cases, you need to add the configuration operation into the URL. HTTP methods are mapped to ACS operations:

n HTTP GET—View an object or multiple objects.

n HTTP POST—Create a new object.

n HTTP DELETE—Delete a object.

n HTTP PUT—Update an existing object. PUT is also used to invoke extrinsic methods (other than CRUD).

When the HTTP PUT method is used for operations other than CRUD, the URL specifies the required operation. This is also used to distinguish the message from the PUT method for update. The keyword “op” is included in the URL as follows:

Rest/{package}/{ObjectType}/op/{operation}

For example, /Rest/Identity/IdentityGroup/op/query

Table 3 HTTP Method Summary

Function

HTTP Method

URL

Request content

Response on Success

getAll

GET

/{ObjectType}

None

Collection of Objects

getAllDevices

GET

/{ObjectType}

None

List of all devices with basic information and without Network Device Group information.

getByName

GET

/{ObjectType}/name/

{name}1

None

An Object

getById

GET

/{ObjectType}/id/{id}

None

An Object

create

POST

/{ObjectType}

Object
For create, the Object ID property should not be set.

Rest Response Result, which includes Object ID.

delete

DELETE

/{ObjectType}/name/

{name}1

None

Rest Result

delete

DELETE

/{ObjectType}/ id/{id}

None

Rest Result

update2

PUT

/{ObjectType}

Object

Rest Result

Query

PUT

/{ObjectType}/op/query

QueryObject

List of Objects

nullnull

. The name attribute in these methods is replaced with MAC addresses. This is because of the Host object, which does not have the name attribute.

For the responses on failure, see ACS REST Result.

getAllDevices method

ACS 5.8 introduces a light weight REST API method called “getAllDevices” that helps you to get the list of network devices and AAA clients information without the Network Device Groups. This method returns the list of all network devices with basic and minimal information. The basic information includes the name, IP address, description, device id, version, and authentication related details. This new lightweight “getAllDevices” method increases the response time to fetch data from ACS.

When you use the existing “getAll” method to fetch device information from ACS, if you have 10 or 100 devices, it fetches all information including the network device group quickly. But, when you have 10k devices and you try to fetch data using “getAll” method, it takes around 30 minutes to process the request. Therefore, in such cases, you need to use the light weight “getAllDevices” method. The light weight “getAllDevices” method retrieves the limited basic information from ACS quickly. You can use the name or ID of the device and use “getByName” or “getById” methods to get all related information of that device. Now, you can perform the CRUD operations on the objects that are received.

If you are going to use the light weight “getAllDevices” API method, update to the version field in ACS will be done by ACS itself, however, you can add a version field in your custom database and modify it. The version field indicates that the number of times an object is modified. This version field must be increased by one every time in your custom database when you update that object. When you retrieve data using “getAllDevices” method, the version field is also retrieved from ACS. You need to compare the object version in your custom database with the retrieved objects version from ACS. You need to compare the versions in your custom database with the records that are fetched from ACS. If the retrieved version of the object is different from what you have it in your custom database, then you need to update that object using the “getByName” or “getById” API methods.

Multiple Parallel REST requests results in Denial of Service in ACS:

When a primary ACS node receives a REST request, it verifies the administrator credentials and establishes a TCP connection with the REST client and stores the authentication results along with the last login time and replicates the results secondary nodes.

When ACS receives multiple parallel REST requests at the same time, ACS tries to store the authentication results in the database and replicate the results to all secondary nodes. This results in denial of service in ACS.

It is recommended to establish a connection against ACS and use this connection for all the subsequent REST requests to avoid the stability issues.

n If you use Java clients, you can register the client against ACS, establish a TCP connection, and use this connection for all subsequent requests. For more information, see REST client Java class section on the SDK examples of in ACS Web interface (System Administration > Downloads > REST Service > SDK samples)

n If you use CURL clients, you must save the cookies from CURL program and use the cookies for all subsequent REST requests.

To save and use CURL cookies, complete the following steps:

1. Execute the following command to save the cookies in cookies.txt file:

curl -c cookies.txt https://<ACS_IP_ADRESS>/REST/Common/AcsVersion

2. Execute the following command to use the cookies from cookies.txt file

curl -b cookies.txt https://<ACS_IP_ADRESS>/REST/Common/AcsVersion

Response Structure

The response to REST request is a standard HTTP response that includes the HTTP status code and other data that is returned by web servers. In addition, the response can include the ACS REST result object or ACS configuration objects according to the type of request.

You should check the HTTP status code to find out the type of objects that are expected in the response body.

n For 4xx HTTPS status codes except for 401 and 404, REST result object is returned.

n For 5xx status codes other than 500, the message content includes text that describe the server error.

n For 500 HTTP status codes, REST result is returned.

n For 200 and 201 HTTP status codes, objects per the specific method or object type are returned.

n For 204 HTTP status codes, no object is returned.

HTTP Status Codes

ACS returns the following types of status codes:

n 2xx for success

n 4xx for client errors

n 5xx for server errors

ACS does not return the following types of status codes:

n 1xx

n 3xx

The HTTP status code is returned within the HTTP response headers as well as within the REST result object.

Table 4 Usage of HTTP Status Codes

Status Code

Message

Usage in ACS

Comment

200

OK

Successful Get, create and query

—

204

OK with no content

Successful delete and update

No data is returned in the response body.

400

Bad Request

Request errors: Object validation failure, XML syntax error, and other error in request message

The request contains bad syntax or cannot be executed.

For example, if you try to create an object with a name that already exists, the object validation fails.

Detailed reasons can be found in the REST result object.

401

Unauthorized

Authentication Failure/ Time outs

Similar to 403 error, but specifically for use when authentication failed or credentials are not available.

403

Forbidden

ACS is a secondary and cannot fulfill the request, or operation is not allowed per administrator authorization.

The request was valid, but the server refuses to respond to it.

Unlike a 401 error, authenticating will make no difference. Also, this error is displayed when an non-read request was sent to a secondary instance.

404

Not Found

For cases where the URL is wrong or the REST service is not enabled

—

410

Gone

A resource is no longer available.

A request was made for an object that does not exist. For example, deleting an object that does not exist.

500

Internal Server Error

For any server error that has no specific HTTP code.

—

ACS REST Result

The HTTP response for a REST request includes either requested objects or a REST result object. See Table 3 for details. ACS result includes:

n HTTP status code

n HTTP status text

n ACS message code

n ACS message

n Object ID for successful CREATE method

Returned Objects

ACS returns objects for GET method and for query operation. The type of returned object is determined by the request URL.

When a GET method returns multiple objects, these are included in the response. If the returned list is too long, you should use filtering or paging options.

WADL File

The WADL files contain the object structure (schema) and the methods for every object.

The WADL files are mainly documentation aids. You cannot generate client applications using WADL files.

The WADL file structure is according to W3C specification. For more information, see http://www.w3.org/Submission/wadl/

To download the WADL files:

1. From the ACS user interface, go to System Administration > Downloads > Rest Service

2. Under ACS Rest Service WADL files, click Common or Identity and save the files to your local drive.

Schema File

ACS is shipped with four XSD files that describe the structure of the objects that are supported on ACS 5.8 REST interfaces.

The four XSD files are:

n Common.xsd, which describes the following objects:

— Version

— AttributeInfo

— Error Message

— ResultResult, RestCreateResult

— BaseObject

— Service Location

— Status

— RestCommonOperationType

n Identity.xsd, which describes the following objects:

— Users

— Hosts

— IdentityGroup

n Query.xsd, which describes the structure of query objects.

n NetworkDevice.xsd, which describes the following objects:

— Network Devices

— Network Device Groups

— Network Device Group Types

You can download the schema files in the same way as you download the WADL files. You can use the schema with available tools such as JAXB to generate schema classes.

You can develop HTTP client or use any third-party HTTP client code and integrate it with the schema classes that are generated from the XSD files.

It is highly recommended to generate REST client classes from the XSD files rather than coding XML or creating it manually.

Sample Code

ACS provides sample code for client application to help you develop an application that interacts with ACS REST Interface. The sample code can be downloaded in the same way as WADL and schema files.

The sample code is based on Apache HTTP Client http://hc.apache.org/httpcomponents-client-ga/index.html and JAVA code generated by JAXB (xjc command) with the help of the XSD files. It includes sample codes for:

n Get ACS Version

n Get all users

n Get All Service Locations

n Get Filtered list of Users

n Get list of Error messages

n Get User by ID and by name

n Create, Delete, Update user

n Create, Delete, and Update identity group

n Get IdentityGroup by name or ID

n Get sub-tree of IdentityGroups

n Get all Users of an Identity Group

n Create, Delete, Update Network Device

n Get Network Devices by ID and by name

n Get All Network Devices

n Query for Network Device

n Create, Delete, Update Network Device Group

n Get Network Device Group by ID or by name

n Get sub-tree of Network Device Group

n Query for Network Device Group

n Create, Delete, Update Network Device Group Type

n Get Network Device Group Type by ID and by name

n Get All Network Device Group Type

n Query for Network Device Group Type

n Create, Delete, Update Internal Host

n Get Internal Host by ID or Name

n Get All Internal Host

n Query for Internal Host

Changing Internal User Password from REST API

ACS allows you to change the user password from REST API. You can use the GET method from REST API to retrieve the change password XML file from ACS. You can enter the old password and new password in the retrieved XML file and use the PUT method to update the password in ACS. This feature is applicable only for the internal users.

Before you Begin:

Ensure that the REST API is enabled in ACS. To enable REST API, execute the acs config-web-interface rest enable command in EXEC mode of ACS CLI.

To change user password from REST API:

1. Open the REST API client.

2. Enter https://<IP address>/Rest/UCP/User/name/<username> in the Request URL field; where <IP address> is the IP address of the ACS instance in which the user account is present and <username> is the username of the user for whom you want to change the password.

3. Select GET from the Method drop-down list and click SEND.

4. Enter the old password and the new password in the XML code.

6. Select PUT from the Method drop-down list and click SEND.

REST API displays the response dialog box with the status as “204 No Content” after successfully changing the password.

If the password changing operation fails, then REST API displays the corresponding error codes and error messages in the XML code. See Table 4 for more information on Error Codes.

1. Names in the URL are full names. ACS REST services does not support wildcards or regular expressions.

2. Update method replaces the entire object with the object provided in the request body, with the exception of sensitive properties.

Using the Scripting Interface

This chapter describes the scripting interface that ACS 5.8 provides to perform bulk operations on ACS objects using the Import and Export features.

ACS provides the import and export functionalities through the web interface (graphical user interface) as well as the CLI. ACS exposes these functionalities through the CLI to enable you to create custom shell scripts for bulk operations on ACS objects. The import-data command allows you to:

n Add ACS objects

n Update ACS objects

n Delete ACS objects

The import and export functionalities in ACS 5.8 allow you to perform bulk operations such as Create, Update, and Delete on ACS objects and provide a migration path for customers migrating from ACS 4.x releases to ACS 5.8.

You can integrate ACS with any of your repositories and import data into ACS through automated scripts, using the Import and Export features. You can also encrypt the .csv file before you transfer the file for additional security, or, optionally, use Secure File Transfer Protocol (SFTP).

You can create a scheduled command that looks for a file with a fixed name in the repository to perform bulk operations. This option provides the functionality that was available in ACS 4.x releases.

ACS processes the import and export requests in a queue. Only one process can run at a time. When you use the ACS web interface for importing and exporting, you cannot manually control the queue.

ACS processes the queue in sequence. However, you can use the CLI to manage the import and export processes in ACS. The ACS CLI allows you to view the status of the queue and terminate the processes that are in the queue.

This chapter contains the following sections:

n Understanding Import and Export in ACS

n Supported ACS Objects

n Creating Import Files

n Using Shell Scripts to Perform Bulk Operations

Understanding Import and Export in ACS

You can use the import functionality in ACS to add, update, or delete multiple ACS objects at the same time. ACS uses a comma-separated values (CSV) file to perform these bulk operations. This .csv file is called an import file.

ACS provides a separate .csv template for Add, Update, and Delete operations for each ACS object. The first record in the .csv file is the header record from the template that contains column (field) names. You must download these templates from the ACS web interface. The header record from the template must be included in the first row of any .csv file that you import.

You cannot use the same template to import all ACS objects. You must download the template that is designed for each ACS object and use the corresponding template while importing the objects.

You can use the export functionality to create a .csv file that contains all the records of a particular object type that are available in the ACS internal store.

You must have CLI administrator-level access to perform import and export operations. Additionally:

n To import ACS configuration data, you need CRUD permissions for the specific configuration object.

n To export data to a remote repository, you need read permission for the specific configuration object.

This section contains:

n Importing ACS Objects Through the CLI

n Exporting ACS Objects Through the CLI

n Viewing the Status of Import and Export Processes

n Terminating Import and Export Processes

Importing ACS Objects Through the CLI

You can import ACS objects from the ACS Configuration mode. You use the import-data command to perform the Import operation. This command takes the following arguments:

n Name of the remote repository where the import file resides. See Creating Import Files, for information on how to create the import file.

n Name of the import file.

n Type of ACS object that the import file contains.

ACS obtains the .csv file from the remote repository and processes the file. You can query ACS for the status of the import process using the import-export-status command. After the import process is complete, ACS generates a status file in the remote repository that includes any errors that ACS identified during this process.

For additional security during the import process, you have the option of encrypting the import file and using a secured remote repository for the import operation.

Also, the import process sometimes can run into errors. You can specify whether you want to terminate the import process or continue it until it is complete.

value.

For example, to add internal user records to an existing identity store, from the ACS CLI, enter:

import-data add user repository file-name result-file-name {abort-on-error | cont-on-error} {full | none | only-sec-repo | only-sec-files} secret-phrase

Syntax Description

repository—Name of the remote repository from which to import the ACS objects, in this case, the internal users.

file-name—Name of the import file in the remote repository.

result-file-name—Name of the file that contains the results of the import operation. This file is available in the remote repository when the import process completes or is terminated.

abort-on-error—Aborts the import operation if an error occurs during the import process.

cont-on-error—Ignores any errors that occur during the import process and continues to import the rest of the object.

full—Encrypts the import file using the GNU Privacy Guard (GPG) encryption mechanism and uses secured remote repository to import the file. If you specify the security type as full, you must specify SFTP as the repository value.

none—Neither encrypts the import file nor uses the secured remote repository for import.

secret phrase—Provide the secret phrase to decrypt the import file. If you specify the security type as full or only-sec-files, you must specify the secret phrase.

only-sec-repo—Uses the secured remote repository to import the file. If you specify the security type as only-sec-repo, you must specify SFTP as the repository value.

only-sec-files—Encrypts the import file using GPG encryption mechanism.

For more information on the import-data command, see CLI Reference Guide for Cisco Secure Access Control System 5.8.

Exporting ACS Objects Through the CLI

You can export a list of ACS objects in a .csv file from ACS to your local drive. You can perform this operation from the ACS Configuration mode, using the export-data command. This command takes the following arguments:

n Object type to be exported.

n Name of the remote repository to which the .csv file should be downloaded after the export process is complete.

When ACS processes your export request, you can enter a command to query the progress of the export. After the export process is complete, the .csv file that is available in your remote repository should contain all the object records that exist in the ACS internal store.

When you export ACS objects through the web interface, use the available filters to export a subset of the records.

For additional security during the export process, you have the option of encrypting the export file and using a secured remote repository for the export operation.

If you choose to use a secured remote repository for export, you must specify SFTP as the repository value.

For example, to export internal user records, from the ACS CLI, enter:

export-data user repository file-name result-file-name {full | none | only-sec-repo | only-sec-files} secret-phrase

Syntax Description

repository—Name of the remote repository to which to export the ACS objects, in this case, the internal users.

file-name—Name of the export file in the remote repository.

result-file-name—Name of the file that contains the results of the export operation. This file is available in the remote repository when the export process completes.

full—Encrypts the export file using the GPG encryption mechanism and uses secured remote repository to export the file. If you specify the security type as full, you must specify SFTP as the repository value.

none—Neither encrypts the export file nor uses the secured remote repository for export.

secret phrase—Provide a secret phrase to encrypt the export file. If you specify the security type as full or only-sec-files, you must specify the secret phrase.

only-sec-repo—Uses the secured remote repository to export the file. If you specify the security type as only-sec-repo, you must specify SFTP as the repository value.

only-sec-files—Encrypts the export file using GPG encryption mechanism.

For more information on the export-data command, see CLI Reference Guide for Cisco Secure Access Control System 5.8.

Viewing the Status of Import and Export Processes

You can view the status of the import and export processes in ACS using the import-export-status command. Use this command to view the status of running import and export processes and to verify whether there are any pending processes.

You must run the import-export-status command from the ACS Configuration mode. Any user, irrespective of role, can issue this command.

import-export-status {current | all | id id}

Syntax Description

current—Displays the status of the currently running processes.

all—Displays the status of all the import and export processes, including any pending processes.

id—Displays the import or export status, based on a particular process that is specified by the process ID.

For more information on the import-export-status command, see CLI Reference Guide for Cisco Secure Access Control System 5.8.

Terminating Import and Export Processes

You can use the import-export-abort command to terminate all import and export processes, or process that are currently running or queued. You must run the import-export-abort command from the ACS Configuration mode.

Only the super administrator can simultaneously terminate a running process and all pending import and export processes. However, a user who owns a particular import or export process can terminate that particular process by using the process ID, or by stopping the process when it is running.

import-export-abort {running | all | id id}

Syntax Description

current—Aborts any import or export process that is running currently.

all—Aborts all the import and export processes in the queue.

id—Aborts the import or export process, based on the process ID that you specify.

For more information on the import-export-abort command, see CLI Reference Guide for Cisco Secure Access Control System 5.8.

Supported ACS Objects

While ACS 5.8 allows you to perform bulk operations (Add, Update, Delete) on ACS objects using the import functionality, you cannot import all ACS objects. The import functionality in ACS 5.8 supports the following ACS objects:

n Users

n Hosts

n Network Devices

n Identity Groups

n NDGs

n Downloadable ACLs

n Command Sets

Table 1 ACS Objects – Property Names and Data Types

Property Name

Property Data Type

Object Type: User

Username

(Required in create, edit, and delete) String. Maximum length is 64 characters.

Description

(Optional) String. Maximum length is 1024 characters.

Enabled

(Required in create) Boolean.

Change Password

(Required in create) Boolean.

Password

(Required in create) String. Maximum length is 32 characters. Not available in Export.

Enable Password

(Optional) String. Maximum length is 32 characters.

User Identity Group

(Optional) String. Maximum length is 256 characters.

List of attributes

(Optional) String and other data types.

Object Type: Hosts

MAC address

(Required in create, edit, delete) String. Maximum length is 64 characters.

Description

(Optional) String. Maximum length is 1024 characters.

Enabled

(Optional) Boolean.

Host Identity Group

(Optional) String. Maximum length is 256 characters.

List of attributes

(Optional) String.

Object Type: Network Device

Name

(Required in create, edit, delete) String. Maximum length is 64 characters.

Description

(Optional) String. Maximum length is 1024 characters.

Subnet

(Required in create) String.

Support RADIUS

(Required in create) Boolean.

RADIUS secret

(Optional) String. Maximum length is 32 characters.

Support TACACS

(Required in create) Boolean.

TACACS secret

(Optional) String. Maximum length is 32 characters.

Single connect

(Optional) Boolean.

Legacy TACACS

(Optional) Boolean.

Support CTS

(Required in create) Boolean.

CTS Identity

(Optional) String. Maximum length is 32 characters.

CTS trusted

(Optional) Boolean.

Password

(Optional) String. Maximum length is 32 characters.

sgACLTTL

(Optional) Integer.

peerAZNTTL

(Optional) Integer.

envDataTTL

(Optional) Integer.

Session timeout

(Optional) Integer.

List of NDG names

(Optional) String.

Object Type: Identity Group

Name

(Required in create, edit, delete) String. Maximum length is 64 characters.

Description

(Optional) String. Maximum length is 1024 characters.

Object Type: NDG

Name

(Required in create, edit, delete) String. Maximum length is 64 characters.

Description

(Optional) String. Maximum length is 1024 characters.

Object Type: Downloadable ACLs

Name

(Required in create, edit, delete) String. Maximum length is 64 characters.

Description

(Optional) String. Maximum length is 1024 characters.

Content

(Required in create, edit, delete) String. Maximum length is 1024 characters.

Object Type: Command Set

Name

(Required in create, edit, delete) String. Maximum length is 64 characters.

Description

(Optional) String. Maximum length is 1024 characters.

Commands (in the form of grant:command:arguments)

(Optional) String.
.

Fields that are optional can be left empty and ACS substitutes the default values for those fields.

For example, when fields that are related to a hierarchy are left blank, ACS assigns the value of the root node in the hierarchy. For network devices, if TrustSec is enabled, all related configuration fields are set to default values.

.

command.

Creating Import Files

This section describes how to create the csv file for performing bulk operations on ACS objects. You can download the appropriate template for each of the objects. This section contains the following:

n Downloading the Template from the Web Interface

n Understanding the CSV Templates

n Creating the Import File

Downloading the Template from the Web Interface

Before you can create the import file, you must download the import file templates from the ACS web interface.

To download the import file templates for adding internal users:

1. Log into the ACS 5.8 web interface.

2. Choose Users and Identity Stores > Internal Identity Stores > Users.

The Users page appears.

3. Click File Operations.

The File Operations wizard appears.

4. Choose any one of the following:

n Add—Adds users to the existing list. This option does not modify the existing list. Instead, it performs an append operation.

n Update—Updates the existing internal user list.

n Delete—Deletes the list of users in the import file from the internal identity store.

5. Click Next.

The Template page appears.

6. Click Download Add Template.

7. Click Save to save the template to your local disk.

The following list gives you the location from which you can get the appropriate template for each of the objects:

n User—Users and Identity Stores > Internal Identity Stores > Users

n Hosts—Users and Identity Stores > Internal Identity Stores > Hosts

n Network Device—Network Resources > Network Devices and AAA Clients

n Identity Group—Users and Identity Stores > Identity Groups

n NDG

— Location—Network Resources > Network Device Groups > Location

— Device Type—Network Resources > Network Device Groups > Device Type

n Downloadable ACLs—Policy Elements > Authorization and Permissions > Named Permission Objects > Downloadable ACLs

n Command Set—Policy Elements > Authorization and Permissions > Device Administration > Command Sets

Follow the procedure described in this section to download the appropriate template for your object.

Understanding the CSV Templates

You can open your CSV template in Microsoft Excel or any other spreadsheet application and save the template to your local disk as a .csv file. The .csv template contains a header row that lists the properties of the corresponding ACS object.

Table 2 Internal User Add Template

Header Field

Description

name:String(64):Required

Username of the user.

description:String(1024)

Description of the user.

enabled:Boolean(true,false):Required

Boolean field that indicates whether the user must be enabled or disabled.

changePassword:Boolean(true,false):Required

Boolean field that indicates whether the user must change password on first login.

password:String(32):Required

Password of the user.

enablePassword:String(32)

Enable password of the user.

UserIdentityGroup:String(256)

Identity group to which the user belongs.

All the user attributes that you have specified would appear here.

Each row of the .csv file corresponds to one internal user record. You must enter the values into the .csv file and save it before you can import the users into ACS. See Creating the Import File for more information on how to create the import file.

This example is based on the internal user Add template. For the other ACS object templates, the header row contains the properties described in Table 1 for that object.

Creating the Import File

After you download the import file template to your local disk, enter the records that you want to import into ACS in the format specified in the template. After you enter all records into the .csv file, you can proceed with the import function. The import process involves the following:

n Adding Records to the ACS Internal Store

n Updating the Records in the ACS Internal Store

n Deleting Records from the ACS Internal Store

Adding Records to the ACS Internal Store

When you add records to the ACS internal store, you add the records to the existing list. This is an append operation, in which the records in the .csv file are added to the list that exists in ACS.

To add internal user records to the Add template:

1. Download the internal user Add template. See Downloading the Template from the Web Interface for more information.

2. Open the internal user Add template in Microsoft Excel or any other spreadsheet application. See Table 1 for a description of the fields in the header row of the template.

3. Enter the internal user information. Each row of the .csv template corresponds to one user record.

Figure 1 Figure 1 shows a sample Add Users import file.

Figure 1 Add Users – Import File

4. Save the add users import file to your local disk.

Updating the Records in the ACS Internal Store

When you update the records in the ACS store, the import process overwrites the existing records in the internal store with the records from the .csv file. This operation replaces the records that exist in ACS with the records from the .csv files.

The Update operation is similar to the Add operation except for one additional column that you can add to the Update templates.

The Update template can contain an Updated Name column for internal users and other ACS objects, and an Updated MAC address column for the internal hosts. The name shown in the Updated Name column replaces the name in the ACS identity store.

Instead of downloading the update template for each of the ACS objects, you can use the export file of that object, retain the header row, and update the data to create your updated .csv file.

To add an updated name or MAC address to the ACS objects, you must download and use the particular update template. Also, for the NDGs, the export template contains only the NDG name, so in order to update any other property, you must download and use the NDG update template.

Figure 2 shows a sample import file that updates existing user records.

Figure 2 Update Users–Import File

The second column, Updated name, is the additional column that you can add to the Update template. Also, the password value and the enabled password value are not mandatory in the case of an update operation for the user object.

Deleting Records from the ACS Internal Store

You can use this option to delete a subset of records from the ACS internal store. The records that are present in the .csv file that you import are deleted from the ACS internal store. The Delete template contains only the key column to identify the records that must be deleted.

For example, to delete a set of internal users from the ACS internal identity store, download the internal user Delete template and add the list of users that you want to delete to this Import file. Figure 3 shows a sample Import file that deletes internal user records.

To delete all users, you can export all users and then use the export file as your import file to delete users.

Figure 3 Delete Users – Import File

Using Shell Scripts to Perform Bulk Operations

You can write custom shell scripts that use the import and export CLI commands to perform bulk operations. The ACS web interface provides a sample Python script. To download this sample script:

1. Log into the ACS web interface.

2. Choose System Administration > Downloads > Scripts.

The downloadable package consists of:

n Python module, Pexpect

n Python script

n ReadMe—Contains installation instructions

You must have Python software to run this script.

Sample Shell Script

import pexpect

# Create connection to a specific IP using 'admin' username

connector = pexpect.spawn('ssh admin@1.2.3.4')

connector.expect('.ssword:*')

# Enter password

connector.sendline('defaultPass')

connector.expect('.$')

# Defining a repository that point to the localdisc

connector.sendline('configure')

connector.expect('.$')

connector.sendline('repository localRepo')

connector.expect('.$')

connector.sendline('url disk:/')

connector.expect('.$')

connector.sendline('exit')

connector.expect('.$')

connector.sendline('exit')

connector.expect('.$')

# Saving the repository

connector.sendline('write memory')

connector.expect('.$')

# Going into acs-config mode

connector.sendline('acs-config')

connector.expect('.ername:*')

# Enter acs admin username

connector.sendline('acsadmin')

connector.expect('.ssword:*')

# Enter acs admin password

connector.sendline('1111')

connector.expect('.config-acs*')

connector.sendline('import-data add device local device.csv device_res.csv cont-on-error none') # Performing the import command

connector.expect('.$')

# Exit acs-config mode

connector.sendline('exit')

connector.expect('.$')

# Exit ssh mode

connector.sendline('exit')

Monitoring and Report Viewer Database Schema

ACS allows you to export data from the Viewer database to a Microsoft SQL server or an Oracle System ID (SID) in a remote server. This feature allows you to create custom reporting applications that meet your specific needs.

For example, you can export the data from the Viewer database to your remote database on another server that contains your customized reporting application. To export data, you must first configure a remote database in ACS.

This appendix describes how to configure a remote database and the tables in the Monitoring and Report Viewer database. This appendix provides the Monitoring and Report Viewer database schema for both Microsoft SQL server and Oracle SID.

The following topics are included:

n Configuring a Remote Database in ACS

n Understanding the Monitoring and Report Viewer Database Schema

— Microsoft SQL Server Schema

— Oracle Schema

Configuring a Remote Database in ACS

You can configure a remote database to which ACS exports the Monitoring and Report Viewer data at specified intervals in minutes or hours. You can schedule the export job to be run once every 1, 2, 4, 6, 8, 12, or 24 hours.

You can create custom reporting applications that interact with this remote database. ACS supports the following databases:

n Oracle SQL Developer 10g

n Microsoft SQL Server 2005

To configure a remote database:

1. Log into the ACS web interface.

2. From the Monitoring and Report Viewer, choose Monitoring Configuration > System Configuration > Remote Database Settings.

Table 1 Remote Database Settings Page

Option

Description

Publish to Remote Database

Check the check box for ACS to export data to the remote database periodically. By default, ACS exports data to the remote database every 4 hours.

Server

Enter the DNS name or the IP address of the remote database.

Port

Enter the port number of the remote database.

Username

Enter the username for remote database access.

Password

Enter the password for remote database access.

Publish data every n hours

Choose a time interval from the drop-down list box for ACS to export data at the specified interval in minutes or hours.

Database Type

The type of remote database that you want to configure:

n Click the Microsoft Database radio button to configure a Microsoft database and enter the name of the remote database.

n Click the Oracle SID radio button to configure an Oracle database and enter the system identifier for the Oracle database.

3. Click Submit to configure the remote database.

Understanding the Monitoring and Report Viewer Database Schema

The Monitoring and Report Viewer collects data for:

n Accounting

n AAA Audit

The tables that contain AAA diagnostics, system diagnostics, and administrative audit data are not exported.

The Viewer database contains raw and aggregated tables. This section contains the following topics:

n Raw Tables

n Aggregated Tables

n Microsoft SQL Server Schema

n Oracle Schema

Raw Tables

The raw tables contain individual records. The Monitoring and Report Viewer aggregates the records in the raw tables and stores the aggregated data in aggregated tables. The passed and failed bit fields in the raw tables are not encoded and are represented as 1s and 0s.

Aggregated Tables

The aggregated tables contain a count of passed and failed authentications for various data combinations. For example, for a user User1, from identity group A, with NAD B, and access policy C, the Monitoring and Report Viewer computes the passed and failed counts on a daily basis and stores it in the monthly tables.

Monthly Tables

The daily count of passed and failed authentications for various data combinations are stored in the monthly tables.

Yearly Tables

At the end of every month, the Monitoring and Report Viewer computes the passed and failed counts for that month and stores them in the yearly tables.

You can choose to work with individual records from the raw tables or you can get the counts directly from these aggregated tables. In the aggregated tables, passed and failed counts are available for various data combinations.

The Passed, Failed, TotalResponseTime, and MaxResponseTime fields are not part of any data combination. The total response time is computed in milliseconds for both passed and failed authentications. The day field in the month tables is set to date only and does not include the time.

Table 2 provides a list of tables, a brief description, and a list of aggregated tables.

Table 2 Monitoring and Report Viewer Database Schema

Purpose

Table

Description

Aggregated Tables

Accounting

TACACS Accounting (acstacacsaccounting)

TACACS Session—Start and stop, watchdog process, and rejected session information.

acstacacsaccountingmonth

acstacacsaccountingyear

RADIUS Accounting (acsradiusaccounting)

RADIUS Session—Start, stop, and update information.

acsradiusaccountingmonth

acsradiusaccountingyear

AAA Audit

TACACS Authentication (acstacacsauthentication)

TACACS—Passed authentications and failed attempts.

acstacacsauthenticationmonth

acstacacsauthenticationyear

TACACS Authorization (acstacacsauthorization)

TACACS device administration—Command and session authorization passed and failed attempts.

acstacacsauthorizationmonth

acstacacsauthorizationyear

RADIUS Authentication (acsradiusauthentication)

RADIUS—Passed authentications and failed attempts.

acsradiusauthenticationmonth

acsradiusauthenticationyear

Microsoft SQL Server Schema

The Monitoring and Report Viewer database in Microsoft SQL Server contains the acstacacsauthentication tables.

The acstacacsauthentication table contains the fields described in Table 3.

acstacacsauthentication

Table 3 acstacacsauthentication Table

Column

Data Type

ID

integer

ACSTimestamp

datetime,

ACSViewTimestamp

datetime,

ACSServer

varchar(500),

MessageCode

varchar(10),

ACSSessionID

varchar(500)

AccessService

varchar(500)

ServiceSelectionPolicy

varchar(500)

AuthorizationPolicy

text

UserName

varchar(500)

IdentityStore

varchar(500)

AuthenticationMethod

varchar(500)

AuthenType

varchar(500)

NetworkDeviceName

varchar(500)

DeviceIPAddress

varchar(500)

IdentityGroup

text

NetworkDeviceGroups

text

Response

text

PriviligeLevel

varchar(10)

FailureReason

varchar(500)

ADDomain

varchar(500)

AuthenMethod

varchar(500)

GroupMappingPolicyMatchedR

varchar(500)

IdentityPolicyMatchedRule

varchar(500)

QueryIdentityStores

varchar(500)

RemoteAddress

varchar(500)

SelectedAuthenticationIdenti

varchar(500)

SelectedQueryIdentityStores

varchar(500)

Service

varchar(500)

AVPair

text

ExecutionSteps

text

OtherAttributes

text

SelectedShellProfile

varchar(500)

AuthorizationExceptionPolicyMa

varchar(500)

ResponseTime

integer

Passed

bit

Failed

bit

acstacacsauthenticationmonth

Table 4 acstacacsauthenticationmonth Table

Column

Data Type

ID

integer

Day

smalldatetime

ACSServer

varchar(500)

MessageCode

varchar(10)

AccessService

varchar(500)

ServiceSelectionPolicy

varchar(500)

UserName

varchar(500)

IdentityStore

varchar(500)

NetworkDeviceName

varchar(500)

DeviceIPAddress

varchar(500)

IdentityGroup

text

NetworkDeviceGroups

text

FailureReason

varchar(500)

ADDomain

varchar(500)

UseCase

varchar(500)

Passed

integer

Failed

integer

TotalResponseTime

integer

MaxResponseTime

integer

acstacacsauthenticationyear

Table 5 acstacacsauthenticationyear Table

Column

Data Type

ID

integer

Month

varchar(10)

ACSServer

varchar(500)

MessageCode

varchar(10)

AccessService

varchar(500)

ServiceSelectionPolicy

varchar(500)

UserName

varchar(500)

IdentityStore

varchar(500)

NetworkDeviceName

varchar(500)

DeviceIPAddress

varchar(500)

IdentityGroup

text

NetworkDeviceGroups

text

FailureReason

varchar(500)

ADDomain

varchar(500)

UseCase

varchar(500)

Passed

integer

Failed

integer

TotalResponseTime

integer

MaxResponseTime

integer

acsradiusauthentication

Table 6 acsradiusauthentication Table

Column

Data Type

ID

integer

ACSTimestamp

datetime

ACSViewTimestamp

datetime

ACSServer

varchar(500)

MessageCode

varchar(10)

ACSSessionID

varchar(500)

AccessService

varchar(500)

ServiceSelectionPolicy

varchar(500)

AuthorizationPolicy

text

UserName

varchar(500)

IdentityStore

varchar(500)

AuthenticationMethod

varchar(500)

NetworkDeviceName

varchar(500)

IdentityGroup

text

NetworkDeviceGroups

text

Response

text

CallingStationID

varchar(500)

NASPort

varchar(500)

ServiceType

varchar(500)

AuditSessionID

varchar(500)

CTSSecurityGroup

varchar(500)

FailureReason

varchar(500)

UseCase

varchar(500)

ExecutionSteps

text

FramedIPAddress

varchar(500)

NASIdentifier

varchar(500)

NASIPAddress

varchar(500)

NASPortId

varchar(500)

CiscoAVPair

text

ADDomain

varchar(500)

RadiusResponse

text

ACSUserName

varchar(500)

RadiusUserName

varchar(500)

NACRole

varchar(500)

NACPolicyCompliance

varchar(500)

NACUsername

varchar(500)

NACPostureToken

varchar(500)

NACRadiusIsUserAuthenticated

varchar(10)

SelectedPostureServer

varchar(500)

SelectedIdentityStore

varchar(500)

AuthenticationIdentityStore

varchar(500)

AuthorizationExceptionPolicyMa

varchar(500)

ExternalPolicyServerMatchedRul

varchar(500)

GroupMappingPolicyMatchedRule

varchar(500)

IdentityPolicyMatchedRule

varchar(500)

NASPortType

varchar(500)

QueryIdentityStores

varchar(500)

SelectedAuthorizationProfiles

text

SelectedExceptionAuthorization

varchar(500)

SelectedQueryIdentityStores

varchar(500)

EapAuthentication

varchar(500)

EapTunnel

varchar(500)

TunnelDetails

text

CiscoH323Attributes

text

CiscoSSGAttributes

text

OtherAttributes

text

ResponseTime

integer

NADFailure

bit

Passed

bit

Failed

bit

acsradiusauthenticationmonth

Table 7 acsradiusauthenticationmonth Table

Column

Data Type

ID

integer

Day

smalldatetime

ACSServer

varchar(500)

MessageCode

varchar(10)

AccessService

varchar(500)

ServiceSelectionPolicy

varchar(500)

AuthorizationPolicy

text

UserName

varchar(500)

IdentityStore

varchar(500)

NetworkDeviceName

varchar(500)

IdentityGroup

text

NetworkDeviceGroups

text

CallingStationID

varchar(500)

FailureReason

varchar(500)

NASIdentifier

varchar(500)

NASIPAddress

varchar(500)

NASPortId

varchar(500)

ADDomain

varchar(500)

UseCase

varchar(500)

SelectedAuthorizationProfiles

text

CTSSecurityGroup

varchar(500)

Passed

integer

Failed

integer

TotalResponseTime

integer

MaxResponseTime

integer

acsradiusauthenticationyear

Table 8 acsradiusauthenticationyear Table

Column

Data Type

ID

integer

Month

varchar(10)

ACSServer

varchar(500)

MessageCode

varchar(10)

AccessService

varchar(500)

ServiceSelectionPolicy

varchar(500)

AuthorizationPolicy

text

UserName

varchar(500)

IdentityStore

varchar(500)

NetworkDeviceName

varchar(500)

IdentityGroup

text

NetworkDeviceGroups

text

CallingStationID

varchar(500)

FailureReason

varchar(500)

NASIdentifier

varchar(500)

NASIPAddress

varchar(500)

NASPortId

varchar(500)

ADDomain

varchar(500)

UseCase

varchar(500)

SelectedAuthorizationProfiles

text

CTSSecurityGroup

varchar(500)

Passed

integer

Failed

integer

TotalResponseTime

integer

MaxResponseTime

integer

acstacacsauthorization

Table 9 acstacacsauthorization Table

Column

Data Type

ID

integer

ACSTIMESTAMP

datetime

ACSViewTIMESTAMP

datetime

ACSServer

varchar(500)

MessageCode

varchar(10)

ACSSessionID

varchar(500)

AccessService

varchar(500)

ServiceSelectionPolicy

varchar(500)

AuthorizationPolicy

text

UserName

varchar(500)

Response

text

NetworkDeviceName

varchar(500)

DeviceIPAddress

varchar(500)

PriviligeLevel

varchar(10)

CmdSet

text

MatchedCommandSet

varchar(500)

SelectedShellProfile

varchar(500)

SelectedCommandSet

varchar(500)

AuthorizationFailureReason

varchar(500)

FailedShellAttribute

varchar(500)

IdentityGroup

text

NetworkDeviceGroups

text

AuthenMethod

varchar(500)

AuthorizationExceptionPolicyMa

varchar(500)

AuthorReplyStatus

varchar(500)

FailureReason

varchar(500)

GroupMappingPolicyMatchedRule

varchar(500)

IdentityPolicyMatchedRule

varchar(500)

QueryIdentityStores

varchar(500)

RemoteAddress

varchar(500)

SelectedAuthorizationProfiles

text

SelectedExceptionAuthorization

varchar(500)

AVPair

text

ExecutionSteps

text

OtherAttributes

text

AuthenType

varchar(500)

IdentityStore

varchar(500)

ADDomain

varchar(500)

SelectedIdentityStore

varchar(500)

SelectedQueryIdentityStore

varchar(500)

ResponseTime

integer

Passed

bit

Failed

bit

acstacacsauthorizationmonth

Table 10 acstacacsauthorizationmonth Table

Column

Data Type

ID

integer

Day

smalldatetime

ACSServer

varchar(500)

MessageCode

varchar(10)

AccessService

varchar(500)

ServiceSelectionPolicy

varchar(500)

AuthorizationPolicy

text

UserName

varchar(500)

NetworkDeviceName

varchar(500)

DeviceIPAddress

varchar(500)

PriviligeLevel

varchar(10)

CmdSet

text

MatchedCommandSet

varchar(500)

SelectedShellProfile

varchar(500)

SelectedCommandSet

varchar(500)

AuthorizationFailureReason

varchar(500)

FailedShellAttribute

varchar(500)

IdentityGroup

text

NetworkDeviceGroups

text

TotalResponseTime

integer

Passed

integer

Failed

integer

acstacacsauthorizationyear

Table 11 acstacacsauthorizationyear Table

Column

Data Type

ID

integer

Month

varchar(10)

ACSServer

varchar(500)

MessageCode

varchar(10)

AccessService

varchar(500)

ServiceSelectionPolicy

varchar(500)

AuthorizationPolicy

text

UserName

varchar(500)

NetworkDeviceName

varchar(500)

DeviceIPAddress

varchar(500)

PriviligeLevel

varchar(10)

CmdSet

text

MatchedCommandSet

varchar(500)

SelectedShellProfile

varchar(500)

SelectedCommandSet

varchar(500)

AuthorizationFailureReason

varchar(500)

FailedShellAttribute

varchar(500)

IdentityGroup

text

NetworkDeviceGroups

text

TotalResponseTime

integer

Passed

integer

Failed

integer

acstacacsaccounting

Table 12 acstacacsaccounting Table

Column

Data Type

ID

integer

ACSTimestamp

datetime

ACSViewTimestamp

datetime

ACSServer

varchar(500)

MessageCode

varchar(10)

ACSSessionID

varchar(500)

AccessService

varchar(500)

UserName

varchar(500)

RemoteAddress

varchar(500)

AcctRequestFlags

varchar(500)

AuthenMethod

varchar(500)

ServiceType

varchar(500)

Service

varchar(500)

NetworkDeviceName

varchar(500)

Port

varchar(500)

NetworkDeviceGroups

text

DeviceIPAddress

varchar(500)

SourceIPAddress

varchar(500)

PrivilegeLevel

varchar(10)

CmdSet

text

ServerMsg

varchar(500)

ServiceArgument

varchar(500)

AVPair

text

AcctInputPackets

numeric(15)

AcctOutputPackets

numeric(15)

AcctTerminateCause

varchar(500)

AcctSessionTime

numeric(15)

AcctSessionId

varchar(500)

ExecutionSteps

text

Response

text

OtherAttributes

text

ResponseTime

integer

Started

smallint

Stopped

smallint

SessionKey

varchar(500)

acstacacsaccountingmonth

Table 13 acstacacsaccountingmonth Table

Column

Data Type

ID

Integer

Day

smalldatetime

ACSServer

varchar(500)

MessageCode

varchar(10)

AccessService

varchar(500)

UserName

varchar(500)

RemoteAddress

varchar(500)

Service

varchar(500)

NetworkDeviceName

varchar(500)

NetworkDeviceGroups

text

DeviceIPAddress

varchar(500)

SourceIPAddress

varchar(500)

PrivilegeLevel

varchar(10)

CmdSet

text

Count

integer

TotalResponseTime

bigint

MaxResponseTime

numeric(15)

Active

integer

Throughput

bigint

TotalSessionTime

bigint

MaxSessionTime

numeric(15)

Started

integer

Stopped

integer

acstacacsaccountingyear

Table 14 acstacacsaccountingyear Table

Column

Data Type

ID

integer

Month

varchar(10)

ACSServer

varchar(500)

MessageCode

varchar(10)

AccessService

varchar(500)

UserName

varchar(500)

RemoteAddress

varchar(500)

Service

varchar(500)

NetworkDeviceName

varchar(500)

NetworkDeviceGroups

text

DeviceIPAddress

varchar(500)

SourceIPAddress

varchar(500)

PrivilegeLevel

varchar(10)

CmdSet

text

Count

integer

TotalResponseTime

bigint

MaxResponseTime

numeric(11)

Active

Integer

Throughput

bigint

TotalSessionTime

bigint

MaxSessionTime

numeric(15)

Started

integer

Stopped

integer

acsradiusaccounting

Table 15 acsradiusaccounting Table

Column

Data Type

ID

Integer

ACSTimestamp

datetime

ACSViewTimestamp

datetime

ACSServer

varchar(500)

MessageCode

varchar(10)

ACSSessionID

varchar(500)

UserName

varchar(500)

CallingStationID

varchar(500)

AcctSessionId

varchar(500)

AcctStatusType

varchar(500)

AcctSessionTime

varchar(500)

ServiceType

varchar(500)

FramedProtocol

varchar(500)

AcctInputOctets

varchar(500)

AcctOutputOctets

varchar(500)

AcctInputPackets

varchar(500)

AcctOutputPackets

varchar(500)

FramedIPAddress

varchar(500)

NASPort

varchar(500)

NASIPAddress

varchar(500)

CiscoAVPair

text

Class

varchar(500)

AcctTerminateCause

varchar(500)

AccessService

varchar(500)

AuditSessionID

varchar(500)

AcctMultiSessionID

varchar(500)

AcctAuthentic

varchar(500)

TerminationAction

varchar(500)

SessionTimeout

varchar(500)

IdleTimeout

varchar(500)

AcctInterimInterval

varchar(500)

AcctDelayTime

varchar(500)

EventTimestamp

varchar(500)

NASIdentifier

varchar(500)

NASPortId

varchar(500)

AcctTunnelConnection

varchar(500)

AcctTunnelPacketLost

varchar(500)

NetworkDeviceName

varchar(500)

NetworkDeviceGroups

text

ServiceSelectionPolicy

varchar(500)

IdentityStore

varchar(500)

ADDomain

varchar(500)

IdentityGroup

varchar(500)

AuthorizationPolicy

varchar(500)

FailureReason

varchar(500)

SecurityGroup

varchar(500)

TunnelDetails

text

CiscoH323SetupTime

datetime

CiscoH323ConnectTime

datetime

CiscoH323DisconnectTime

datetime

CiscoH323Attributes

text

CiscoSSGAttributes

text

ExecutionSteps

text

OtherAttributes

text

ResponseTime

integer

Started

smallint

Stopped

smallint

SessionKey

varchar(500)

acsradiusaccountingmonth

Table 16 acsradiusaccountingmonth Table

Column

Data Type

ID

Integer

Day

smalldatetime

ACSServer

varchar(500)

MessageCode

varchar(10)

AccessService

varchar(500)

UserName

varchar(500)

CallingStationID

varchar(500)

AcctTerminateCause

varchar(500)

TerminationAction

varchar(500)

NASIdentifier

varchar(500)

NASIPAddress

varchar(500)

NetworkDeviceName

varchar(500)

NetworkDeviceGroups

varchar(500)

IdentityStore

varchar(500)

ADDomain

varchar(500)

IdentityGroup

varchar(500)

AuthorizationPolicy

varchar(500)

AcctStatusType

varchar(500)

FramedIPAddress

varchar(500)

Count

integer

TotalResponseTime

bigint

MaxResponseTime

numeric(15)

Active

Integer

Throughput

bigint

TotalSessionTime

bigint

MaxSessionTime

numeric(15)

Started

integer

Stopped

integer

acsradiusaccountingyear

Table 17 acsradiusaccountingyear Table

Column

Data Type

ID

Integer

Month

varchar(10)

ACSServer

varchar(500)

MessageCode

varchar(10)

AccessService

varchar(500)

UserName

varchar(500)

CallingStationID

varchar(500)

AcctTerminateCause

varchar(500)

TerminationAction

varchar(500)

NASIdentifier

varchar(500)

NASIPAddress

varchar(500)

NetworkDeviceName

varchar(500)

NetworkDeviceGroups

varchar(500)

IdentityStore

varchar(500)

ADDomain

varchar(500)

IdentityGroup

varchar(500)

AuthorizationPolicy

varchar(500)

AcctStatusType

varchar(500)

FramedIPAddress

varchar(500)

Count

integer

TotalResponseTime

bigint

MaxResponseTime

numeric(15)

Active

integer

Throughput

bigint

TotalSessionTime

bigint

MaxSessionTime

numeric(15)

Started

integer

Stopped

integer

acsaaadiagnostics

Table 18 acsaaadiagnostics Table

Column

Data Type

ID

integer

ACSTimestamp

datetime

ACSViewTimestamp

datetime

ACSServer

varchar(500)

MessageCode

varchar(10)

MessageSeverity

varchar(10)

ACSSessionID

varchar(500)

Category

varchar(500)

DiagnosticInfo

text

acsadministratorlogin

Table 19 acsadministratorlogin Table

Column

Data Type

ID

integer

ACSTimestamp

datetime

ACSViewTimestamp

datetime

ACSServer

varchar(500)

MessageCode

varchar(10)

AdminName

varchar(500)

AdminIPAddress

varchar(100)

AdminSession

varchar(100)

AdminInterface

varchar(10)

acsconfigurationchanges

Table 20 acsconfigurationchanges Table

Column

Data Type

ID

integer

ACSTimestamp

datetime

ACSViewTimestamp

datetime

ACSServer

varchar(500)

MessageCode

varchar(10)

AdminName

varchar(500)

AdminIPAddress

varchar(100)

AdminSession

varchar(100)

AdminInterface

varchar(10)

ObjectType

varchar(500)

ObjectName

varchar(500)

RequestedOperation

varchar(100)

OperationMessageText

varchar(1000)

ConfigChangeData

text

HostID

varchar(100)

RequestResponseType

varchar(10)

FailureFlag

varchar(10)

Details

varchar(1000)

OperatorName

varchar(500)

UserAdminFlag

varchar(10)

AccountName

varchar(500)

DeviceIP

varchar(15)

IdentityStoreName

varchar(500)

ChangePasswordMethod

varchar(10)

AuditPasswordType

varchar(10)

ObjectID

varchar(100)

AppliedToACSInstance

varchar(500)

LocalMode

bit

acslogcollectionfailures

Table 21 acslogcollectionfailures Table

Column

Data Type

ID

integer

ACSViewTimestamp

datetime

ACSServer

varchar(500)

ACSLoggingCategory

varchar(100)

Error

text

acsmessagecatalog

Table 22 acsmessagecatalog Table

Column

Data Type

ID

integer

MESSAGECODE

integer

MESSAGECLASS

varchar(100)

MESSAGETEXT

text

acsprocessstatus

Table 23 acsprocessstatus Table

Column

Data Type

ID

integer

ACSTimestamp

datetime

ACSViewTimestamp

datetime

ACSServer

varchar(500)

MessageCode

varchar(10)

NodeId

smallint

NodeName

varchar(500)

Role

varchar(100)

DatabaseProc

bit

Management

bit

Runtime

bit

Adclient

bit

ViewDatabase

bit

ViewCollector

bit

ViewJobManager

bit

ViewAlertManager

bit

ViewLogProcessor

bit

acssystemstatus

Table 24 acssystemstatus Table

Column

Data Type

ID

integer

ACSTimestamp

datetime

ACSViewTimestamp

datetime

ACSServer

varchar(500)

MessageCode

varchar(10)

CPUUtilization

decimal(5,2)

NetworkUtilizationRcvd

integer

NetworkUtilizationSent

integer

MemoryUtilization

decimal(5,2)

DiskIOUtilization

decimal(5,2)

DiskSpaceUtilizationRoot

decimal(5,2)

DiskSpaceUtilizationAltRoot

decimal(5,2)

DiskSpaceUtilizationBoot

decimal(5,2)

DiskSpaceUtilizationHome

decimal(5,2)

DiskSpaceUtilizationLocaldisk

decimal(5,2)

DiskSpaceUtilizationOpt

decimal(5,2)

DiskSpaceUtilizationRecovery

decimal(5,2)

DiskSpaceUtilizationStoredconf

decimal(5,2)

DiskSpaceUtilizationStoreddata

decimal(5,2)

DiskSpaceUtilizationTmp

decimal(5,2)

DiskSpaceUtilizationRuntime

decimal(5,2)

AverageRadiusRequestLatency

integer

AverageTacacsRequestLatency

integer

DeltaRadiusRequestCount

integer

DeltaTacacsRequestCount

integer

acssystemdiagnostics

Table 25 acssystemdiagnostics Table

Column

Data Type

ID

integer

ACSTimestamp

datetime

ACSViewTimestamp

datetime

ACSServer

varchar(500)

MessageCode

varchar(10)

MessageSeverity

varchar(10)

Category

varchar(100)

DiagnosticInfo

text

acsviewnetflowaggregation

Table 26 acsviewnetflowaggregation Table

Column

Data Type

ID

integer

ACSViewTimestamp

datetime

SourceUsername

varchar(500)

SourceAddress

varchar(15)

SourcePort

varchar(50)

DestinationUsername

varchar(500)

DestinationAddress

varchar(15)

DestinationPort

varchar(50)

SGTName

varchar(100)

SGTValue

integer

DGTName

varchar(100)

DGTValue

integer

NASIPAddress

varchar(15)

Protocol

varchar(50)

ACLDrops

integer

checkpointday

Table 27 checkpointday Table

Column

Data Type

ID

integer

Type

smallint

Timestamp

datetime

AuditSessionID

varchar(100)

ACSServer

varchar(100)

ACSSessionID

varchar(100)

NASIP

varchar(41)

EndpointMAC

varchar(100)

EndpointIP

varchar(41)

UserName

varchar(500)

VLAN

varchar(100)

dACL

varchar(100)

AuthenticationType

varchar(500)

InterfaceName

varchar(100)

Reason

varchar(500)

nadaaastatus

Table 28 nadaaastatus Table

Column

Data Type

ID

integer

Timestamp

datetime

Alive

bit

ACSServer

varchar(100)

NASIP

varchar(100)

DeviceGroups

text

Oracle Schema

The Monitoring and Report Viewer database in AD contains the following tables:

acstacacsauthentication

Table 29 acstacacsauthentication Table

Column

Data Type

ID

integer

ACSTimestamp

timestamp

ACSViewTimestamp

timestamp

ACSServer

varchar2(500)

MessageCode

varchar2(10)

ACSSessionID

varchar2(500)

AccessService

varchar2(500)

ServiceSelectionPolicy

varchar2(500)

AuthorizationPolicy

clob

UserName

varchar2(500)

IdentityStore

varchar2(500)

AuthenticationMethod

varchar2(500)

AuthenType

varchar2(500)

NetworkDeviceName

varchar2(500)

DeviceIPAddress

varchar2(500)

IdentityGroup

clob

NetworkDeviceGroups

clob

Response

clob

PriviligeLevel

varchar2(500)

FailureReason

varchar2(500)

ADDomain

varchar2(500)

AuthenMethod

varchar2(500)

GroupMappingPolicyMatchedR

varchar2(500)

IdentityPolicyMatchedRule

varchar2(500)

QueryIdentityStores

varchar2(500)

RemoteAddress

varchar2(500)

SelectedAuthenticationIdenti

varchar2(500)

SelectedQueryIdentityStores

varchar2(500)

Service

varchar2(500)

AVPair

clob

ExecutionSteps

clob

OtherAttributes

clob

SelectedShellProfile

varchar2(500)

AuthorizationExceptionPolicyMa

varchar2(500)

ResponseTime

integer

Passed

smallint

Failed

smallint

acstacacsauthenticationmonth

Table 30 acstacacsauthenticationmonth Table

Column

Data Type

ID

integer

Day

date

ACSServer

varchar2(500)

MessageCode

varchar2(10)

AccessService

varchar2(500)

ServiceSelectionPolicy

varchar2(500)

UserName

varchar2(500)

IdentityStore

varchar2(500)

NetworkDeviceName

varchar2(500)

DeviceIPAddress

varchar2(500)

IdentityGroup

clob

NetworkDeviceGroups

clob

FailureReason

varchar2(500)

ADDomain

varchar2(500)

UseCase

varchar2(500)

Passed

integer

Failed

integer

TotalResponseTime

integer

MaxResponseTime

integer

acstacacsauthenticationyear

Table 31 acstacacsauthenticationyear Table

Column

Data Type

ID

integer

Month

varchar2(10)

ACSServer

varchar2(500)

MessageCode

varchar2(10)

AccessService

varchar2(500)

ServiceSelectionPolicy

varchar2(500)

UserName

varchar2(500)

IdentityStore

varchar2(500)

NetworkDeviceName

varchar2(500)

DeviceIPAddress

varchar2(500)

IdentityGroup

clob

NetworkDeviceGroups

clob

FailureReason

varchar2(500)

ADDomain

varchar2(500)

UseCase

varchar2(500)

Passed

integer

Failed

integer

TotalResponseTime

integer

MaxResponseTime

integer

acsradiusauthentication

Table 32 acsradiusauthentication Table

Column

Data Type

ID

integer

ACSTimestamp

timestamp

ACSViewTimestamp

timestamp

ACSServer

varchar2(500)

MessageCode

varchar2(10)

ACSSessionID

varchar2(500)

AccessService

varchar2(500)

ServiceSelectionPolicy

varchar2(500)

AuthorizationPolicy

clob

UserName

varchar2(500)

IdentityStore

varchar2(500)

AuthenticationMethod

varchar2(500)

NetworkDeviceName

varchar2(500)

IdentityGroup

clob

NetworkDeviceGroups

clob

Response

clob

CallingStationID

varchar2(500)

NASPort

varchar2(500)

ServiceType

varchar2(500)

AuditSessionID

varchar2(500)

CTSSecurityGroup

varchar2(500)

FailureReason

varchar2(500)

UseCase

varchar2(500)

ExecutionSteps

clob

FramedIPAddress

varchar2(500)

NASIdentifier

varchar2(500)

NASIPAddress

varchar2(500)

NASPortId

varchar2(500)

CiscoAVPair

clob

ADDomain

varchar2(500)

RadiusResponse

clob

ACSUserName

varchar2(500)

RadiusUserName

varchar2(500)

NACRole

varchar2(500)

NACPolicyCompliance

varchar2(500)

NACUsername

varchar2(500)

NACPostureToken

varchar2(500)

NACRadiusIsUserAuthenticated

varchar2(500)

SelectedPostureServer

varchar2(500)

SelectedIdentityStore

varchar2(500)

AuthenticationIdentityStore

varchar2(500)

AuthorizationExceptionPolicyMa

varchar2(500)

ExternalPolicyServerMatchedRul

varchar2(500)

GroupMappingPolicyMatchedRule

varchar2(500)

IdentityPolicyMatchedRule

varchar2(500)

NASPortType

varchar2(500)

QueryIdentityStores

varchar2(500)

SelectedAuthorizationProfiles

varchar2(500)

SelectedExceptionAuthorization

varchar2(500)

SelectedQueryIdentityStores

varchar2(500)

EapAuthentication

varchar2(500)

EapTunnel

varchar2(500)

TunnelDetails

clob

CiscoH323Attributes

clob

CiscoSSGAttributes

clob

OtherAttributes

clob

ResponseTime

integer

NADFailure

smallint

Passed

integer

Failed

integer

acsradiusauthenticationmonth

Table 33 acsradiusauthenticationmonth Table

Column

Data Type

ID

integer

Day

date

ACSServer

varchar2(500)

MessageCode

varchar2(10)

AccessService

varchar2(500)

ServiceSelectionPolicy

varchar2(500)

AuthorizationPolicy

clob

UserName

varchar2(500)

IdentityStore

varchar2(500)

NetworkDeviceName

varchar2(500)

IdentityGroup

clob

NetworkDeviceGroups

clob

CallingStationID

varchar2(500)

FailureReason

varchar2(500)

NASIdentifier

varchar2(500)

NASIPAddress

varchar2(500)

ADDomain

varchar2(500)

UseCase

varchar2(500)

SelectedAuthorizationProfiles

varchar2(500)

CTSSecurityGroup

varchar2(500)

Passed

integer

Failed

integer

TotalResponseTime

integer

MaxResponseTime

integer

acsradiusauthenticationyear

Table 34 acsradiusauthenticationyear Table

Column

Data Type

ID

integer

Month

varchar2(10)

ACSServer

varchar2(500)

MessageCode

varchar2(10)

AccessService

varchar2(500)

ServiceSelectionPolicy

varchar2(500)

AuthorizationPolicy

clob

UserName

varchar2(500)

IdentityStore

varchar2(500)

NetworkDeviceName

varchar2(500)

IdentityGroup

clob

NetworkDeviceGroups

clob

CallingStationID

varchar2(500)

FailureReason

varchar2(500)

NASIdentifier

varchar2(500)

NASIPAddress

varchar2(500)

ADDomain

varchar2(500)

UseCase

varchar2(500)

SelectedAuthorizationProfiles

varchar2(500)

CTSSecurityGroup

varchar2(500)

Passed

integer

Failed

integer

TotalResponseTime

integer

MaxResponseTime

integer

acstacacsauthorization

Table 35 acstacacsauthorization Table

Column

Data Type

ID

integer

ACSTIMESTAMP

timestamp

ACSViewTIMESTAMP

timestamp

ACSServer

varchar2(500)

MessageCode

varchar2(10)

ACSSessionID

varchar2(500)

AccessService

varchar2(500)

ServiceSelectionPolicy

varchar2(500)

AuthorizationPolicy

clob

UserName

varchar2(500)

Response

clob

NetworkDeviceName

varchar2(500)

DeviceIPAddress

varchar2(500)

PriviligeLevel

varchar(10)

CmdSet

varchar2(500)

MatchedCommandSet

varchar2(500)

SelectedShellProfile

varchar2(500)

SelectedCommandSet

varchar2(500)

AuthorizationFailureReason

varchar2(500)

FailedShellAttribute

varchar2(500)

IdentityGroup

clob

NetworkDeviceGroups

clob

AuthenMethod

varchar2(500)

AuthorizationExceptionPolicyMa

varchar2(500)

AuthorReplyStatus

varchar2(500)

FailureReason

varchar2(500)

GroupMappingPolicyMatchedRule

varchar2(500)

IdentityPolicyMatchedRule

varchar2(500)

QueryIdentityStores

varchar2(500)

RemoteAddress

varchar2(500)

SelectedAuthorizationProfiles

varchar2(500)

SelectedExceptionAuthorization

varchar2(500)

AVPair

clob

ExecutionSteps

clob

OtherAttributes

clob

AuthenType

varchar2(500)

IdentityStore

varchar2(500)

ADDomain

varchar2(500)

SelectedIdentityStore

varchar2(500)

SelectedQueryIdentityStore

varchar2(500)

ResponseTime

integer

Passed

small int

Failed

smallint

acstacacsauthorizationmonth

Table 36 acstacacsauthorizationmonth Table

Column

Data Type

ID

integer

Day

date

ACSServer

varchar2(500)

MessageCode

varchar2(10)

AccessService

varchar2(500)

ServiceSelectionPolicy

varchar2(500)

AuthorizationPolicy

clob

UserName

varchar2(500)

NetworkDeviceName

varchar2(500)

DeviceIPAddress

varchar2(500)

PriviligeLevel

varchar2(10)

CmdSet

varchar2(500)

MatchedCommandSet

varchar2(500)

SelectedShellProfile

varchar2(500)

SelectedCommandSet

varchar2(500)

AuthorizationFailureReason

varchar2(500)

FailedShellAttribute

varchar2(500)

IdentityGroup

clob

NetworkDeviceGroups

clob

TotalResponseTime

integer

Passed

integer

Failed

integer

acstacacsauthorizationyear

Table 37 acstacacsauthorizationyear Table

Column

Data Type

ID

integer

Month

varchar2(10)

ACSServer

varchar2(500)

MessageCode

varchar2(10)

AccessService

varchar2(500)

ServiceSelectionPolicy

varchar2(500)

AuthorizationPolicy

clob

UserName

varchar2(500)

NetworkDeviceName

varchar2(500)

DeviceIPAddress

varchar2(500)

PriviligeLevel

varchar2(10)

CmdSet

varchar2(500)

MatchedCommandSet

varchar2(500)

SelectedShellProfile

varchar2(500)

SelectedCommandSet

varchar2(500)

AuthorizationFailureReason

varchar2(500)

FailedShellAttribute

varchar2(500)

IdentityGroup

clob

NetworkDeviceGroups

clob

TotalResponseTime

integer

Passed

integer

Failed

integer

acstacacsaccounting

Table 38 acstacacsaccounting Table

Column

Data Type

ID

integer

ACSTimestamp

timestamp

ACSViewTimestamp

timestamp

ACSServer

varchar2(500)

MessageCode

varchar2(10)

ACSSessionID

varchar2(500)

AccessService

varchar2(500)

UserName

varchar2(500)

RemoteAddress

varchar2(500)

AcctRequestFlags

varchar2(10)

AuthenMethod

varchar2(20)

ServiceType

varchar2(20)

Service

varchar2(500)

NetworkDeviceName

varchar2(500)

Port

varchar2(500)

NetworkDeviceGroups

clob

DeviceIPAddress

varchar2(500)

SourceIPAddress

varchar2(500)

PrivilegeLevel

varchar2(10)

CmdSet

varchar2(500)

ServerMsg

varchar2(500)

ServiceArgument

varchar2(500)

AVPair

clob

AcctInputPackets

number(6)

AcctOutputPackets

number(6)

AcctTerminateCause

varchar2(500)

AcctSessionTime

number(6)

AcctSessionId

varchar2(500)

ExecutionSteps

clob

Response

clob

OtherAttributes

clob

ResponseTime

integer

Started

smallint

Stopped

smallint

SessionKey

varchar2(500)

acstacacsaccountingmonth

Table 39 acstacacsaccountingmonth Table

Column

Data Type

ID

integer

Day

date

ACSServer

varchar2(500)

MessageCode

varchar2(10)

AccessService

varchar2(500)

UserName

varchar2(500)

RemoteAddress

varchar2(500)

Service

varchar2(500)

NetworkDeviceName

varchar2(500)

NetworkDeviceGroups

clob

DeviceIPAddress

varchar2(500)

SourceIPAddress

varchar2(500)

PrivilegeLevel

varchar2(10)

CmdSet

varchar2(500)

Count

integer

TotalResponseTime

number(20)

MaxResponseTime

number(6)

Active

integer

Throughput

number(20)

TotalSessionTime

number(20)

MaxSessionTime

number(6)

Started

integer

Stopped

integer

acstacacsaccountingyear

Table 40 acstacacsaccountingyear Table

Column

Data Type

ID

integer

Month

varchar2(10)

ACSServer

varchar2(500)

MessageCode

varchar2(10)

AccessService

varchar2(500)

UserName

varchar2(500)

RemoteAddress

varchar2(500)

Service

varchar2(500)

NetworkDeviceName

varchar2(500)

NetworkDeviceGroups

clob

DeviceIPAddress

varchar2(500)

SourceIPAddress

varchar2(500)

PrivilegeLevel

varchar2(10)

CmdSet

varchar2(500)

Count

integer

TotalResponseTime

number(20)

MaxResponseTime

number(6)

Active

integer

Throughput

number(20)

TotalSessionTime

number(20)

MaxSessionTime

number(6)

Started

integer

Stopped

integer

acsradiusaccounting

Table 41 acsradiusaccounting Table

Column

Data Type

ID

integer

ACSTimestamp

timestamp

ACSViewTimestamp

timestamp

ACSServer

varchar2(500)

MessageCode

varchar2(10)

ACSSessionID

varchar2(500)

UserName

varchar2(500)

CallingStationID

varchar2(500)

AcctSessionId

varchar2(500)

AcctStatusType

varchar2(500)

AcctSessionTime

varchar2(500)

ServiceType

varchar2(20)

FramedProtocol

varchar2(500)

AcctInputOctets

varchar2(500)

AcctOutputOctets

varchar2(500)

AcctInputPackets

varchar2(500)

AcctOutputPackets

varchar2(500)

FramedIPAddress

varchar2(500)

NASPort

varchar2(500)

NASIPAddress

varchar2(500)

CiscoAVPair

clob

Class

varchar2(500)

AcctTerminateCause

varchar2(500)

AccessService

varchar2(500)

AuditSessionID

varchar2(500)

AcctMultiSessionID

varchar2(500)

AcctAuthentic

varchar2(10)

TerminationAction

varchar2(500)

SessionTimeout

varchar2(500)

IdleTimeout

varchar2(500)

AcctInterimInterval

varchar2(500)

AcctDelayTime

varchar2(500)

EventTimestamp

varchar2(500)

NASIdentifier

varchar2(500)

NASPortId

varchar2(500)

AcctTunnelConnection

varchar2(500)

AcctTunnelPacketLost

varchar2(500)

NetworkDeviceName

varchar2(500)

NetworkDeviceGroups

varchar2(500)

ServiceSelectionPolicy

varchar2(500)

IdentityStore

varchar2(500)

ADDomain

varchar2(500)

IdentityGroup

varchar2(500)

AuthorizationPolicy

varchar2(500)

FailureReason

varchar2(500)

SecurityGroup

varchar2(500)

TunnelDetails

clob

CiscoH323SetupTime

timestamp

CiscoH323ConnectTime

timestamp

CiscoH323DisconnectTime

timestamp

CiscoH323Attributes

clob

CiscoSSGAttributes

clob

ExecutionSteps

clob

OtherAttributes

clob

ResponseTime

integer

Started

integer

Stopped

integer

SessionKey

varchar2(500)

acsradiusaccountingmonth

Table 42 acsradiusaccountingmonth Table

Column

Data Type

ID

integer

Day

date

ACSServer

varchar2(500)

MessageCode

varchar2(10)

AccessService

varchar2(500)

UserName

varchar2(500)

CallingStationID

varchar2(500)

AcctTerminateCause

varchar2(500)

TerminationAction

varchar2(500)

NASIdentifier

varchar2(500)

NASIPAddress

varchar2(500)

NetworkDeviceName

varchar2(500)

NetworkDeviceGroups

varchar2(500)

IdentityStore

varchar2(500)

ADDomain

varchar2(500)

IdentityGroup

varchar2(500)

AuthorizationPolicy

varchar2(500)

AcctStatusType

varchar2(500)

FramedIPAddress

varchar2(500)

Count

integer

TotalResponseTime

number(20)

MaxResponseTime

number(6)

Active

integer

Throughput

number(20)

TotalSessionTime

number(20)

MaxSessionTime

number(6)

Started

integer

Stopped

integer

acsradiusaccountingyear

Table 43 acsradiusaccountingyear Table

Column

Data Type

ID

integer

Month

varchar2(10)

ACSServer

varchar2(500)

MessageCode

varchar2(10)

AccessService

varchar2(500)

UserName

varchar2(500)

CallingStationID

varchar2(500)

AcctTerminateCause

varchar2(500)

TerminationAction

varchar2(500)

NASIdentifier

varchar2(500)

NASIPAddress

varchar2(500)

NetworkDeviceName

varchar2(500)

NetworkDeviceGroups

varchar2(500)

IdentityStore

varchar2(500)

ADDomain

varchar2(500)

IdentityGroup

varchar2(500)

AuthorizationPolicy

varchar2(500)

AcctStatusType

varchar2(500)

FramedIPAddress

varchar2(500)

Count

integer

TotalResponseTime

number(20)

MaxResponseTime

number(6)

Active

integer

Throughput

number(20)

TotalSessionTime

number(20)

MaxSessionTime

number(6)

Started

integer

Stopped

integer

acsaaadiagnostics

Table 44 acsaaadiagnostics Table

Column

Data Type

ID

integer

ACSTimestamp

datetime

ACSViewTimestamp

datetime

ACSServer

varchar(500)

MessageCode

varchar(10)

MessageSeverity

varchar(10)

ACSSessionID

varchar(500)

Category

varchar(500)

DiagnosticInfo

text

acsadministratorlogin

Table 45 acsadministratorlogin Table

Column

Data Type

ID

integer

ACSTimestamp

datetime

ACSViewTimestamp

datetime

ACSServer

varchar(500)

MessageCode

varchar(10)

AdminName

varchar(500)

AdminIPAddress

varchar(100)

AdminSession

varchar(100)

AdminInterface

varchar(10)

AuthenticationResult

varchar(100)

AuthenticationResultReason

varchar(100)

AdministratorClientIP

varchar(100)

AccessService

varchar(100)

IdentityStore

varchar(100)

AdminAuthorizationResult

varchar(100)

AdminRoles

varchar(100)

AuthenticationMethod

varchar(100)

ActiveDirectoryDomain

varchar(100)

IdentityPolicyMatchedRule

varchar(100)

SelectedIdentityStore

varchar(100)

AuthorizationPolicyMatchedRule

varchar(100)

StaticRoleAssignment

varchar(100)

IsRecovery_Account

varchar(100)

ACSSession_ID

varchar(100)

OtherAttributes

text

ExecutionSteps

text

Response

text

acsconfigurationchanges

Table 46 acsconfigurationchanges Table

Column

Data Type

ID

integer

ACSTimestamp

datetime

ACSViewTimestamp

datetime

ACSServer

varchar(500)

MessageCode

varchar(10)

AdminName

varchar(500)

AdminIPAddress

varchar(100)

AdminSession

varchar(100)

AdminInterface

varchar(10)

ObjectType

varchar(500)

ObjectName

varchar(500)

RequestedOperation

varchar(100)

OperationMessageText

text

ConfigChangeData

text

HostID

varchar(100)

RequestResponseType

varchar(10)

FailureFlag

varchar(10)

Details

text

OperatorName

varchar(500)

UserAdminFlag

varchar(10)

AccountName

varchar(500)

DeviceIP

varchar(15)

IdentityStoreName

varchar(500)

ChangePasswordMethod

varchar(50)

AuditPasswordType

varchar(10)

ObjectID

varchar(100)

AppliedToACSInstance

varchar(500)

LocalMode

bit

acslogcollectionfailures

Table 47 acslogcollectionfailures Table

Column

Data Type

ID

integer

ACSViewTimestamp

datetime

ACSServer

varchar(500)

ACSLoggingCategory

varchar(100)

Error

text

acsmessagecatalog

Table 48 acsmessagecatalog Table

Column

Data Type

ID

integer

MESSAGECODE

bigint

MESSAGECLASS

varchar(100)

MESSAGETEXT

text

acsprocessstatus

Table 49 acsprocessstatus Table

Column

Data Type

ID

integer

ACSTimestamp

datetime

ACSViewTimestamp

datetime

ACSServer

varchar(500)

MessageCode

varchar(10)

NodeId

smallint

NodeName

varchar(500)

Role

varchar(100)

DatabaseProc

bit

Management

bit

Runtime

bit

Adclient

bit

ViewDatabase

bit

ViewCollector

bit

ViewJobManager

bit

ViewAlertManager

bit

ViewLogProcessor

bit

ntpd

bit

acssystemstatus

Table 50 acssystemstatus Table

Column

Data Type

ID

integer

ACSTimestamp

datetime

ACSViewTimestamp

datetime

ACSServer

varchar(500)

MessageCode

varchar(10)

CPUUtilization

decimal(5,2)

MemoryUtilization

decimal(5,2)

DiskIOUtilization

decimal(5,2)

DiskSpaceUtilizationRoot

decimal(5,2)

DiskSpaceUtilizationAltRoot

decimal(5,2)

DiskSpaceUtilizationBoot

decimal(5,2)

DiskSpaceUtilizationHome

decimal(5,2)

DiskSpaceUtilizationLocaldisk

decimal(5,2)

DiskSpaceUtilizationOpt

decimal(5,2)

DiskSpaceUtilizationRecovery

decimal(5,2)

DiskSpaceUtilizationStoredconf

decimal(5,2)

DiskSpaceUtilizationStoreddata

decimal(5,2)

DiskSpaceUtilizationTmp

decimal(5,2)

DiskSpaceUtilizationRuntime

decimal(5,2)

AverageRadiusRequestLatency

integer

AverageTacacsRequestLatency

integer

DeltaRadiusRequestCount

integer

DeltaTacacsRequestCount

integer

NetworkUtilization

text

acssystemdiagnostics

Table 51 acssystemdiagnostics Table

Column

Data Type

ID

integer

ACSTimestamp

datetime

ACSViewTimestamp

datetime

ACSServer

varchar(500)

MessageCode

varchar(10)

MessageSeverity

varchar(10)

Category

varchar(100)

DiagnosticInfo

text

acsviewnetflowaggregation

Table 52 acsviewnetflowaggregation Table

Column

Data TYpe

ID

integer

ACSViewTimestamp

datetime

SourceUsername

varchar(500)

SourceAddress

varchar(15)

SourcePort

varchar(15)

DestinationUsername

varchar(500)

DestinationAddress

varchar(15)

DestinationPort

varchar(50)

SGTName

varchar(15)

SGTValue

integer

DGTName

varchar(15)

DGTValue

integer

NASIPAddress

varchar(15)

Protocol

varchar(15)

ACLDrops

integer

checkpointday

Table 53 checkpointday Table

Column

Data Type

ID

integer

Type

smallint

Timestamp

datetime

AuditSessionID

varchar(100)

ACSServer

varchar(100)

ACSSessionID

varchar(100)

NASIP

varchar(41)

EndpointMAC

varchar(100)

EndpointIP

varchar(41)

UserName

varchar(500)

VLAN

varchar(100)

dACL

varchar(100)

AuthenticationType

varchar(500)

InterfaceName

varchar(100)

Reason

varchar(500)

nadaaastatus

Table 54 nadaaastatus Table

Column

Data Type

ID

integer

Timestamp

datetime

Alive

bit

ACSServer

varchar(100)

NASIP

varchar(100)

DeviceGroups

Software Developer’s Guide for Cisco Secure Access Control System 5.8

March 2017

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks . Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2015 Cisco Systems, Inc. All rights reserved.