topic Re: ACS 5.2 add a user into several groups in Network Access Control

ACS 5.2 add a user into several groups

holzhirt1 — Mon, 11 Mar 2019 00:58:26 GMT

Dear all,

We are running two ACS appliances but we cannot figure out how we can add a user into 2 differents groups.

Here's the context :

We have a company A which is having devices, this company uses Group A.

then we have a company B which is having devices, this company uses Group B.

But the admin has to manage the devices for both companies A & B.

We don't want to mix devices from company A with company B.

Is there a way to add the user into both groups A & B.

Thank you for your help, really appreciated,

Re: ACS 5.2 add a user into several groups

padatta — Wed, 06 Apr 2011 12:45:51 GMT

Hi,

If users are locally defined on ACS' internal DB, they can be part of only a single group.

Paps

Re: ACS 5.2 add a user into several groups

holzhirt1 — Wed, 06 Apr 2011 13:18:06 GMT

Hello,

thank you for your feedback,

But as you can imagine this absolutely not handy.

Is there a workaround to have this working ?

Is Cisco planning a change with this in future releases ?

Thanks

Re: ACS 5.2 add a user into several groups

a-ford — Fri, 03 Jun 2011 02:25:29 GMT

The user repository shouldn't have any real impact on the devices under management. You should be able to segregate the devices into 2 different containers easily enough. To allow your administrator to manage both sets of devices, you must simply permit the identity group that the admin is a member of to admin both sets of devices. If the admin is a unique class of user, create an identity group for the admin alone.

Re: ACS 5.2 add a user into several groups

holzhirt1 — Fri, 03 Jun 2011 06:31:09 GMT

Hello a-ford,

Thank you very much for your answer.

We usually create a container per company.

The idea would be if we have company A and company B to have an user managing both container with limited rights (Like an IT Admin that is in charge for both).

Additionnaly the Admin should have full access on both companies containers.

Is this possible ?

Thank you

Re: ACS 5.2 add a user into several groups

a-ford — Fri, 03 Jun 2011 14:27:32 GMT

That should be easy enough to do. As an example, I would create a new Network Device Group category named Company. Within that category, create a group named Company A and a group named Company B. Associate all devices to their appropriate Company. You can then create 3 Identity Groups (Company A, Company B, and Admin) and create the appropriate user account in each.

Then under the Access Polices, either with the default device admin policy or within newly created policies, you can grant control of Company A and Company B to their respective users as well as granting control of both to your Admin group.