topic ACS 5.2 with UCS 1.4 in Network Access Control

ACS 5.2 with UCS 1.4

daveburns43 — Mon, 11 Mar 2019 01:20:13 GMT

how do i configure user authentication via TACACS on UCS 1.4 with ACS 5.2? My TACACs connection works, and my user authentication is successful, but i can only get read-only rights. I have tried several versions of "cisco-av-pair= role=admin" both as mandatory attributes named role and as cisco-av-pair=role , with "admin" as the value, and i still get read-only.

When i attempt to find any documentation, it only describes ACS 4.2, which is another problem i have with most documentation for new cisco products (i have this exact issue with my NAMs, nothing i do to change the attributes results in successfully logging into the NAM, and all config guides are written in 4.2 speak).

is there any possiblity cisco is going to release some documentation on how to convert 4.2 speak to 5.2 speak?

ACS 5.2 with UCS 1.4

Nicolas Darchis — Mon, 22 Aug 2011 09:40:48 GMT

It's very product dependant. I know nothing about UCS but I know about ACS 🙂

So the attribute you should return is configured as "role" for the attribute name and "admin" as the value.

This document is not about UCS but WCS uses the same av-pairs giving roles so you might get inspiration from that doc.

https://supportforums.cisco.com/docs/DOC-17909

Hope it helps 🙂

ACS 5.2 with UCS 1.4

daveburns43 — Mon, 22 Aug 2011 17:03:28 GMT

while i appreciate the referral, i have tried every permutation of role, roles, Role, role0, role1, etc. with admin, Admin, aaa, etc. as the "mandatory attribute" ...but every time I authenticate via my tacacs login, I get read-only. If I login using a local account, i get whatever role I assigned myself in the UCS manager software.

I would post this question in the UCS forum, but as I mentioned in my original post, I have this exact problem with the WS-SVC-NAM2s I use authenticating against this ACS via tacacs. So I'm relatively certain it's an ACS configuration issue, and not a problem on the UCS side of the house.

ACS 5.2 with UCS 1.4

jintao99 — Tue, 04 Oct 2011 20:18:57 GMT

Hi David,

I got the same issue with you, only got read-only access. Were you able to figure it out?

Thanks,

Tao

ACS 5.2 with UCS 1.4

jintao99 — Wed, 05 Oct 2011 14:39:25 GMT

In case anyone interested, I got it working. The trick is to match the attribute and value as below. And these seems to be same for all Nexus related products.

ACS 5.2 with UCS 1.4

daveburns43 — Wed, 05 Oct 2011 15:01:12 GMT

That is great! shell:roles worked for me as well. now hopefully a similar trick with work for the NAM..

thanks!

ACS 5.2 with UCS 1.4

robertlinquist — Thu, 01 Dec 2011 17:50:29 GMT

The picture link for your solution is broken. What is the syntax? Thanks!

ACS 5.2 with UCS 1.4

jintao99 — Thu, 01 Dec 2011 18:25:25 GMT

Attribute: shell:roles

Requirement: Mandatory

Value: admin

Hope this helps. FYI, as far as I can see, the screenshot is still there.

ACS 5.2 with UCS 1.4

jasonfaraone — Mon, 06 Feb 2012 14:47:30 GMT

When I set this on my generic admin shell profile, it prevents me from defaulting to enable mode (priv 15) on my network devices. I can type "enable", enter my password when prompted, and enter enable mode, but I'd like this to happen automatically, as it did before I made this shell profile change.

Any ideas?