I have deployed a Cisco Prime Lan Management Server and I have configure for TACACS authentication and authorization for users accessing the Prime box via Cisco ACSv5.2. As I have two groups of users, I would like to restrict the access right to the Cisco Prime for these two groups of users (access rights of Helpdesk for one group and Super Admin for another group). I am able to authencated successfully via the Cisco ACSv5.2 however I am always seem to be given the rights of Helpdesk only.
Many Thanks in Advance.
If this is the replacement for CiscoWorks (which i am sure is) you can only authenticate local users in the Prime database with ACS, meaning that you will have to set the same username depending on which database you will use (ACS local db or AD).
So if you have a user named ADuser in Active directory, create a local user account on Prime and map them to the role or group you want them have access to. Configure the tacacs module and then build your ACS so it authenticates the user via AD or local database. Once you login use the AD password and see if the user is mapped in the proper role.
Hope that helps.
*Please rate helpful posts*
I want to integrate the Prime Infrastructure 1.3 with ACS 5.x.
The ACS 5.x authenticates using Active Directory. All devices on the network are configured
to use the ACS 5.x so every user can access or denied to the devices based on their access rights.
I want to have the same way for access to the Prime Infrastructure.
You said that for this besides configure the authorizations on the shell profile on the ACS for
the various different roles we need to create the users locally on the PI?
Thats is really needed?
How we match the autorization groups on the AD and the roles defined on the PI and on the ACS?
I have read several DOCs but not sure if its really possible to give authorizations to the users
from AD based on their asigned AD group.
Thanks in advance