bloxHub

www.infoblox.com/community
3 posts / 0 new
TACACS remote admin group mapping

Hi everyone,

I have configured TACACS authentication on my GridMaster (version 6.3.4). No problem first, when a user authenticate, it's working.

Now, i have some groups on my GridMaster and i would like to know which group need to be mapped a user when the user connect using TACACS authentication.
Looking to the documentation, i create a new custom service "infoblox" on my Tacacs server (a Cisco ACS server version 4.2). On the group setting of the user in the TACACS server i added the custom attribute "infoblox-admin-group=remoteadmins1" (the "remoteadmins1" is the group name of my group in the GridMaster).

When a user authenticate, the user is mapped to the default group ("admin-group") configured and not the "remoteadmins1" group :

2012-07-26 14:00:31 CEST,"xxxxxxx1","LOGIN_ALLOWED","",""," to=AdminConnector ip=xxx.xxx.xxx.xxx auth=TACACS+ group=admin-group apparently_via=GUI: "

Authentication is working, so the TACACS works with the Infoblox device. My problem is only the mapping part.
I added the "remoteadmins1" on the Authentication Policy part "Map the remote admin group to the local group in this order". Same issue.

Thanks a lot for your help if you have an idea.
Paulo

+1
0
-1
Tags
Infoblox Grid,TACACS,Authentication Errors
Re: TACACS remote admin group mapping

Paulo,

The NIOS integration to TACACS+ is designed to support authorization by group. From your description it seems like you are setting it up correctly. If you have an active support contact I recommend you contact our Support team to help you get it working.

Sincerely,

Andrew Voltmer

+1
+1
-1
Re: TACACS remote admin group mapping

Hello,

We found the solution : the custom attribute "infoblox-admin-group=remoteadmins1" need to be on user settings in Cisco ACS server, not on group settings where we have many users.
So for each user, we had this custom attribute and now it's working well.

Sorry didn't share this solution before.
Thanks for your message.

+1
0
-1