topic Re: TACACS for user in multiple groups in Network Access Control

TACACS for user in multiple groups

John.Mason1978 — Mon, 11 Mar 2019 02:45:29 GMT

Quick question about TACACS and a user that needs to be in more than 1 group

We have a networkAdmins group that is linked to the AD domain Admins group with a network admin in it

w then have another group for firewalls which is linked to firewall access group in AD one user is in both groups which have both been created using a manual mapping in TACACS but the user is only showing up in the NetworkAdmin group not in the firewall admin group

any ideas why the user is not showing up or is this even possible

thanks

TACACS for user in multiple groups

nspasov — Thu, 08 Nov 2012 18:51:07 GMT

Hello John-

You can have a user be part of more than one group. You just need to make sure that both of the groups are pulled from AD and then you can build your authorization rules based on that.

Let me know if this makes sense or if you need more details.

TACACS for user in multiple groups

John.Mason1978 — Fri, 09 Nov 2012 09:37:54 GMT

Hi Neo

thanks for the fast reply

that makes sense

so my user for example currently is in the network admins group populated via AD but there are ACS local users in that group

if i remove the local users then the ad should populate both groups with my user

Re: TACACS for user in multiple groups

nspasov — Fri, 09 Nov 2012 18:53:36 GMT

No problem! I have had issues in the past when the local and the domain user are the same. You can still get around that by defining what identity stores are used (for example, excluding the internal user database) and/or by properly constructing your authorization rules.

Also, do are you using ACS 4.x or 5.x?

Thank you for rating!

Re: TACACS for user in multiple groups

John.Mason1978 — Fri, 09 Nov 2012 18:59:11 GMT

Yes I inherrited this system, its version 4 and this excercise has prompted us to redesign the acs

Thanks for your help

Re: TACACS for user in multiple groups

nspasov — Fri, 09 Nov 2012 19:04:18 GMT

Those are always nice when you inherit these type of systems. I don't know if you have had any experience with 5.x but I highly recommend migrating to it. It is much nicer in terms of building blocks, logging, monitoring etc and it does not run on Windows