The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
This chapter includes the following sections:
Cisco UCS supports two methods to authenticate user logins:
![]() Note |
You can only use one authentication method. For example, if you select LDAP as your authentication provider, you cannot use RADIUS or TACACS+ for authentication. However, if the user account in the remote authentication provider does not have at least one Cisco UCS role, Cisco UCS Manager checks the local database to determine whether an account with the same name exists in the local database. |
If a system is configured for one of the supported remote authentication services, you must create a provider for that service to ensure that Cisco UCS Manager can communicate with it. In addition, you need to be aware of the following guidelines that impact user authorization:
You can create user accounts in Cisco UCS Manager or in the remote authentication server.
The temporary sessions for users who log in through remote authentication services can be viewed through Cisco UCS Manager GUI or Cisco UCS Manager CLI.
If you create user accounts in the remote authentication server, you must ensure that the accounts include the roles those users require for working in Cisco UCS Manager and that the names of those roles match the names used in Cisco UCS Manager. If an account does not have the required roles, the user is granted only read-only privileges.
If a Cisco UCS instance uses LDAP as the remote authentication provider, you can do one of the following:
Map an existing attribute to the user roles and locale for the Cisco UCS instance.
Create a CiscoAVPair or other unique attribute in the LDAP service and map that attribute to the user roles and locale for the Cisco UCS instance.
You must configure the LDAP provider in Cisco UCS Manager with the attribute that holds the user roles and locales. When a user logs in, Cisco UCS Manager checks for the value of this attribute when it queries the remote authentication service and validates the user.
If you create a CiscoAVPair attribute for the Cisco UCS instance, use the following definition for the OID:
CN=CiscoAVPair,CN=Schema,CN=Configuration,CN=X objectClass: top objectClass: attributeSchema cn: CiscoAVPair distinguishedName: CN=CiscoAVPair,CN=Schema,CN=Configuration,CN=X instanceType: 0x4 uSNCreated: 26318654 attributeID: 1.3.6.1.4.1.9.287247.1 attributeSyntax: 2.5.5.12 isSingleValued: TRUE showInAdvancedViewOnly: TRUE adminDisplayName: CiscoAVPair adminDescription: UCS User Authorization Field oMSyntax: 64 lDAPDisplayName: CiscoAVPair name: CiscoAVPair objectCategory: CN=Attribute-Schema,CN=Schema,CN=Configuration,CN=X
If a Cisco UCS instance uses RADIUS as the remote authentication provider, you must create a cisco-avpair attribute in the remote authentication service and map that attribute to the user roles and locale for the Cisco UCS instance. When a user logs in, Cisco UCS Manager checks for the value of this attribute when it queries the remote authentication service and validates the user.
![]() Note |
You cannot use any other attribute in RADIUS for the Cisco UCS roles. You must create the required attribute in RADIUS. |
If a Cisco UCS instance uses either RADIUS or TACACS+ as the remote authentication provider, you must create a cisco-av-pair attribute in the remote authentication service and map that attribute to the user roles and locale for the Cisco UCS instance. When a user logs in, Cisco UCS Manager checks for the value of this attribute when it queries the remote authentication service and validates the user.
![]() Note |
You cannot use any other attribute in RADIUS or TACAC+ for the Cisco UCS roles. You must create the attribute required for that specific remote authentication service. |
Configuring LDAP Providers
The properties that you configure in this task apply to all LDAP provider connections defined in Cisco UCS Manager.
Create an LDAP provider.
Perform the following configuration in the LDAP server:
Configure users with the attribute that holds the user role and locale information for Cisco UCS Manager. You can use an existing LDAP attribute that is mapped to the Cisco UCS user roles and locales or create a custom attribute, such as the CiscoAVPair attribute, which has an attribute ID of 1.3.6.1.4.1.9.287247.1.
For a cluster configuration, add the management port IP addresses for both fabric interconnects. This configuration ensures that remote users can continue to log in if the first fabric interconnect fails and the system fails over to the second fabric interconnect. All login requests are sourced from these IP addresses, not the virtual IP address used by Cisco UCS Manager.
Configure the properties for the LDAP provider connections in Cisco UCS Manager.
In Cisco UCS Manager, create a trustpoint containing the certificate of the root CA of the LDAP server.
Step 1 | In the Navigation pane, click the Admin tab. |
Step 2 | In the Admin tab, expand . |
Step 3 | In the Actions area of the General tab, click Create LDAP Provider. |
Step 4 |
In the Create LDAP Provider dialog box:
|
Step 5 | Click Save Changes. |
Select LDAP as the primary authentication service. For more information, see Selecting a Primary Authentication Service.
Step 1 | In the Navigation pane, click the Admin tab. |
Step 2 | In the Admin tab, expand . |
Step 3 | Right-click the LDAP provider you want to delete and choose Delete. |
Step 4 | If Cisco UCS Manager GUI displays a confirmation dialog box, click Yes. |
Configuring RADIUS Providers
The properties that you configure in this task apply to all RADIUS provider connections defined in Cisco UCS Manager.
Step 1 | In the Navigation pane, click the Admin tab. | ||||||
Step 2 | In the Admin tab, expand . | ||||||
Step 3 |
Complete the following fields in the Properties area:
|
||||||
Step 4 | Click Save Changes. |
Create a RADIUS provider.
Perform the following configuration in the RADIUS server:
Create the cisco-avpair attribute. You cannot use an existing RADIUS attribute.
For a cluster configuration, add the management port IP addresses for both fabric interconnects. This configuration ensures that remote users can continue to log in if the first fabric interconnect fails and the system fails over to the second fabric interconnect. All login requests are sourced from these IP addresses, not the virtual IP address used by Cisco UCS Manager.
If you have not already done so, configure the properties for the RADIUS provider connections in Cisco UCS Manager.
Step 1 | In the Navigation pane, click the Admin tab. |
Step 2 | In the Admin tab, expand . |
Step 3 | In the Actions area of the General tab, click Create RADIUS Provider. |
Step 4 |
In the Create RADIUS Provider dialog box:
|
Step 5 | Click Save Changes. |
Select RADIUS as the primary authentication service. For more information, see Selecting a Primary Authentication Service.
Step 1 | In the Navigation pane, click the Admin tab. |
Step 2 | In the Admin tab, expand . |
Step 3 | Right-click the RADIUS provider you want to delete and choose Delete. |
Step 4 | If Cisco UCS Manager GUI displays a confirmation dialog box, click Yes. |
Configuring TACACS+ Providers
The properties that you configure in this task apply to all RADIUS provider connections defined in Cisco UCS Manager.
Step 1 | In the Navigation pane, click the Admin tab. |
Step 2 | In the Admin tab, expand . |
Step 3 |
In the Properties area, complete the Timeout field: The length of time in seconds the system should spend trying to contact the TACACS+ database before it times out. Enter a value from 1 to 60 seconds. The default is 5 seconds. |
Step 4 | Click Save Changes. |
Create an TACACS+ provider.
Perform the following configuration in the TACACS+ server:
Create the cisco-av-pair attribute. You cannot use an existing TACACS+ attribute.
For a cluster configuration, add the management port IP addresses for both fabric interconnects. This configuration ensures that remote users can continue to log in if the first fabric interconnect fails and the system fails over to the second fabric interconnect. All login requests are sourced from these IP addresses, not the virtual IP address used by Cisco UCS Manager.
If you have not already done so, configure the properties for the TACACS+ provider connections in Cisco UCS Manager.
Step 1 | In the Navigation pane, click the Admin tab. |
Step 2 | In the Admin tab, expand . |
Step 3 | In the Actions area of the General tab, click Create TACACS Provider. |
Step 4 |
In the Create TACACS+ Provider dialog box:
|
Step 5 | Click Save Changes. |
Select TACACS as the primary authentication service. For more information, see Selecting a Primary Authentication Service.
Step 1 | In the Navigation pane, click the Admin tab. |
Step 2 | In the Admin tab, expand . |
Step 3 | Right-click the TACACS+ provider you want to delete and choose Delete. |
Step 4 | If Cisco UCS Manager GUI displays a confirmation dialog box, click Yes. |
If the system uses a remote authentication service, create a provider for that authentication service. If you chose console, you do not need to create a provider first.
Step 1 | In the Navigation pane, click the Admin tab. | ||||||||
Step 2 | In the Admin tab, expand . | ||||||||
Step 3 | In the Work pane, click the General tab. | ||||||||
Step 4 |
On the General tab, complete the following fields:
|
||||||||
Step 5 | Click Save Changes. |