topic Re: APIC-EM Cisco-AVPair AAA Attribute and AD in Controllers https://community.cisco.com/t5/controllers/apic-em-cisco-avpair-aaa-attribute-and-ad/m-p/3463197#M1863 <HTML><HEAD></HEAD><BODY><P>Have you tried: cisco-av-pair Scope=ALL:Role=ROLE_ADMIN</P></BODY></HTML> Wed, 07 Dec 2016 21:22:38 GMT ngoldwat 2016-12-07T21:22:38Z APIC-EM Cisco-AVPair AAA Attribute and AD https://community.cisco.com/t5/controllers/apic-em-cisco-avpair-aaa-attribute-and-ad/m-p/3463196#M1862 <HTML><HEAD></HEAD><BODY><P>I am encountering an issue where I am trying to setup AAA for login to the APIC-EM web console. <SPAN style="font-size: 10pt; line-height: 1.5em;">I have added the APIC-EM to my freeradius server and I see an authorization request come through from APIC-EM to the server. </SPAN><SPAN style="font-size: 10pt; line-height: 1.5em;">My radius server does an LDAP check to see if the user belongs to a group _netops in this case and the user matches and is granted access.</SPAN></P><P></P><P>When attempting to login from the web the response I get on the web is "Invalid Login Credentials".</P><P></P><P>I have noticed on the configuration page of External Authentication there is an AAA Attribute as defined as Cisco-AVPair with the following defined&nbsp; “cisco-av-pair= Scope=group-1,group-2:Role=ROLE_OBSERVER&amp;Scope=group-3,group-4:Role=ROLE_ADMIN”.</P><P></P><P>Is it the recommendation to add Cisco-AVPair to the AD schema with the definitions? If so what would that look like as I have seen many different Cisco-AVPair definitions online.</P><P></P><P>One example is:</P><P>Properties&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Value</P><P>Common Name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CiscoAVPair</P><P>LDAP Display Name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CiscoAVPair</P><P>Unique X500 Object ID&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1.3.6.1.4.1.9.287247.1</P><P>Description&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CiscoAVPair</P><P>Syntax&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Case Sensitive String</P><P></P><P>Also in freeradius I am assuming I would add the following to my ldap.attrmap:</P><P>checkItem&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Cisco-AVPair&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Cisco-AVPair</P><P><SPAN style="font-size: 13.3333px;">replyItem&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Cisco-AVPair&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Cisco-AVPair</SPAN></P><P><SPAN style="font-size: 13.3333px;"><BR /></SPAN></P><P><SPAN style="font-size: 13.3333px;">Attached is an example of a login attempt as seen from the freeradius server.<BR /></SPAN></P></BODY></HTML> Fri, 01 Mar 2019 12:33:37 GMT https://community.cisco.com/t5/controllers/apic-em-cisco-avpair-aaa-attribute-and-ad/m-p/3463196#M1862 mgomez 2019-03-01T12:33:37Z Re: APIC-EM Cisco-AVPair AAA Attribute and AD https://community.cisco.com/t5/controllers/apic-em-cisco-avpair-aaa-attribute-and-ad/m-p/3463197#M1863 <HTML><HEAD></HEAD><BODY><P>Have you tried: cisco-av-pair Scope=ALL:Role=ROLE_ADMIN</P></BODY></HTML> Wed, 07 Dec 2016 21:22:38 GMT https://community.cisco.com/t5/controllers/apic-em-cisco-avpair-aaa-attribute-and-ad/m-p/3463197#M1863 ngoldwat 2016-12-07T21:22:38Z