NetMRI uses internal and external authentication systems to control user authentication for performing all administrative tasks. For a simple rollout, you can use the NetMRI local authentication database, which is called the local authentication service, where all user accounts and login information are contained within the appliance. You can also link NetMRI to an external Active Directory, RADIUS, TACACS+ or LDAP authentication server or server group in the enterprise network to perform user authentication and authorization for NetMRI tasks, using the same user roles a
| Anchor | ||||
|---|---|---|---|---|
|
Use the Authentication Services Settings page (Settings icon –> General Settings –> Authentication Services) to configure authentication server settings.
| Anchor | ||||
|---|---|---|---|---|
|
| Anchor | ||||
|---|---|---|---|---|
|
| Anchor | ||||
|---|---|---|---|---|
|
...
Note: The root Admin account is authenticated only through the NetMRI local authentication database. Other administrator accounts can be authenticated and authorized against an external server.
...
If you define one or more authentication servers under Authentication Services Settings, NetMRI uses the account information from those servers in the order given by priority to accept or reject a given username and password. The only exception is the admin account, which is always validated using the Local Database. NetMRI can be accessed by the system administrator even when authentication servers are down or cannot be accessed by the appliance.
You can disable the local authentication service, in which case only the primary Admin account will be locally authenticated. You can also change the priority level of the Local service, which affects the order in which the local service will be activated for authentication requests. For some applications, retaining the Local service as highest priority is recommended.
You can also enable multiple server groups of different types to authenticate and authorize users. Each server group, whether LDAP, AD, RADIUS or TACACS+, and the mapping between the remote user groups with the local NetMRI roles, is referred to as an authentication service. You configure each authentication service to use a group of on or more authentication servers.
For NetMRI user accounts, you define roles and privileges locally in the NetMRI appliance. All user account roles and privileges remain local to the NetMRI appliance and are not directly defined on the RADIUS, TACACS+, LDAP or AD server (for information about user Roles and Privileges, see Creating Admin and User Accounts.) The external server is used for authentication of the user account. Authorization functions are tied to the assignments between the remote user group names and the NetMRI Roles in the desired NetMRI device groups.
The following figure illustrates the authentication and authorization process for users authenticated by remote servers. In the example, two authentication services are configured: a RADIUS service and an Active Directory service. When an admin logs in with a user name and password, NetMRI uses the service configured with the highest Priority setting to authenticate the admin. If authentication fails, NetMRI tries the next-highest-priority service, and so on. For each service, it tries each authentication server in the order given by their priority, until successful or all services fail, including the local authentication service. If all services fail to authenticate the login attempt, NetMRI denies access and generates an error notification.
If authentication succeeds, NetMRI tries to match the user's group names received from the remote server to those assigned to the local roles and device groups defined in the authentication service properties. If it finds a match, the NetMRI appliance applies the privileges of these roles in the specified device groups to the authenticated user. If the appliance does not find a match, it denies access.
...
Note: When a new user is authenticated and authorized through one of the remote services, NetMRI automatically creates the new account locally on the appliance and learns the Roles and device group assignments from the remote service. If there happens to be an established local user account, and the account login is authenticated and authorized by an external service, NetMRI will update its local profile to reflect the Roles and device group assignments granted by the last external authorization.
An admin can use an account's Force Local Authentication setting to prevent a user account from being authenticated and authorized by an external service. This requires the Local authentication service to be the highest-priority service. For information, see User Administration in NetMRI and its subsections.
...
| Anchor | ||||
|---|---|---|---|---|
|
| Anchor | ||||
|---|---|---|---|---|
|
| Anchor | ||||
|---|---|---|---|---|
|
In all cases, configuring authentication protocols for the NetMRI appliance requires creating one or more authentication services from the Settings icon –> General Settings –> Authentication Services page:
...
The following sections describe each authentication and authorization services configuration.
| Anchor | ||||
|---|---|---|---|---|
|
| Anchor | ||||
|---|---|---|---|---|
|
Active Directory™ (AD)
| Anchor | ||||
|---|---|---|---|---|
|
The Active Directory schema is predefined for User and Group entries, which means that in NetMRI, you only need to specify the Domain of the AD server, along with its IP address.
| Anchor | ||||
|---|---|---|---|---|
|
| Anchor | ||||
|---|---|---|---|---|
|
Configuring AD services requires knowledge of the following key values:
...
- Click the Servers tab.
- Click Add to add Active Directory servers to the service. The Add Authentication Server dialog opens.
- Enter the Host/IP Address.
- Choose the Encryption Type: None or SSL. (For information, see Using a Certificate File for an LDAP or AD Service.) In the Encryption field, if you select SSL, the Authentication Port field changes its value to match the SSL protocol.
- If using SSL, choose the certificate from the Certificate drop-down list. (The certificate can be loaded into NetMRI from the server that issued it.)
Note: When configuring authentication using Active Directory with SSL encryption, a fully qualified domain name (FQDN) is required for the Server Name or IP address field in the Add Active Directory Server dialog. - Choose the Priority for the new server in the authentication service. In this context, the priority value determines the order of which servers in the services are queried by NetMRI.
- If necessary, enter the Port value. AD's default TCP application with SSL encryption port is 636, and 389 for non-encrypted communication.
- Click Save to save your configuration.
- Click Cancel to close the dialog.
...
- Click the Remote Groups tab.
- In the Remote Group field, enter the name of an AD server's remote group.
- Choose the Role for the new remote group. (For information, see Defining and Editing Roles.)
- Check the check boxes for the device groups you want to allow for the remote group. Note that the SysAdmin role applies to all device groups. Other roles allow selection of individual device groups.
- Click OK to complete the configuration.
- When finished with the remote group configuration, click Save and then Close. Note that you can add multiple Roles for the remote group.
- Click Test to test the server settings. Enter a valid username and password. A successful test returns the list of groups to which the test user belongs.
Importing the AD Server Certificate
If the Active Directory server authentication uses SSL, you upload the Active Directory server's CA certificate to NetMRI:
- Open the Settings icon –> General Settings –> Security page and click the CA Certificates tab.
- Click Import.
- In the pop-up window, enter a descriptive name for the certificate and click Browse to locate the Active Directory server's CA certificate.
- Click Import to import the CA certificate to NetMRI.
| Anchor | ||||
|---|---|---|---|---|
|
| Anchor | ||||
|---|---|---|---|---|
|
LDAP (Lightweight Directory Access Protocol)
| Anchor | ||||
|---|---|---|---|---|
|
NetMRI queries the LDAP server for the user account's group membership information. The appliance matches the remote group names from the LDAP server with the group names in its local database. NetMRI then authorizes services and grants the admin privileges, based upon the matching admin group on the appliance.
| Anchor | ||||
|---|---|---|---|---|
|
| Anchor | ||||
|---|---|---|---|---|
|
Configuring LDAP authentication services requires knowledge of the following key values:
- Base distinguished name (Base DN);
- The User attribute;
- The Group attribute;
- Whether to use anonymous or verified (Authenticated) authentication between NetMRI and the LDAP service;
...
- Bind User DN and Bind Password (if known; otherwise anonymous);
- The Search Level (One Level, Base, or Subtree. Subtree is the default).
- The names of the remote groups on the LDAP server containing the users intended to log in to the NetMRI appliance.
To configure an LDAP authentication service for NetMRI, do the following:
- Go to the Settings icon –> NetMRI Settings section –> Authentication Services page.
- Enter the Name and Description.
- Set the Priority and Timeout of the LDAP service.
- Choose LDAP as the Service Type. The Service Specific Information pane updates to show the required LDAP settings.
- Enter the Base DN value for the new LDAP service (example: ou=management,dc=corp100,dc=com). Users' definitions may be split between two or more Base DNs, so be aware of how the directory service is structured.
- Enter the User Attribute (this will typically be cn for 'common name,' which is one of the components of the LDAP Distinguished Name attribute).
- Enter the Group Attribute, which will typically be specified as memberOf for NetMRI. This defines the group membership in the LDAP tree for individual user accounts in LDAP. An example:
jsmith, People, corp100.com
dn: cn=jsmith,ou=People,dc=corp100,dc=com
memberOf:cn=management,ou=Group,dc=corp100,dc=com
You must use the memberOf overlay or a similarly behaving overlay to define the membership.
8. Choose the Search Level, which determines how far the LDAP service searches in the directory tree. The Subtree value is the default and can be retained for most applications. Other options are:
- One Level: Searches the directory entries immediately below the base object.
- Base: searches only the base object.
- Subtree: Search the whole directory tree below and including the base object. This is the default.
9. Choose the Authentication, which can either be Anonymous or Authenticated. (For a fuller description, see the subsection Server Authentication: Anonymous vs. Authenticated below.)
a. If the setting is Authenticated, enter the Bind User DN (this is a core value defined on the LDAP server);
b. Enter the Bind Password, which is associated with the Bind user for the server.
...
Note: Many LDAP services may not allow use of the Bind User DN and Bind Password values, requiring use of anonymous authentication for LDAP queries.
...
10. Click Save.
11. If desired, click Disable service (this completely disables the service but does not change or delete any settings) or Disable authorization (this disables the new service from performing any group searches but allows basic authentication of user accounts from the LDAP server).
To configure the authentication service's LDAP servers, do the following:
- Click the Servers tab.
- Click Add to add LDAP servers to the service. The Add Authentication Server dialog opens.
- Enter the Host/IP Address.
- Choose the Encryption Type: None or SSL. (For information, see Using a Certificate File for an LDAP or ADService.)
- If using SSL, choose the certificate from the Certificate drop-down list. The certificate must be loaded into NetMRI.
- Choose the Priority for the new server in the authentication service. In this context, the priority value determines the order of which servers in the services are queried by NetMRI.
- If necessary, enter the Port value. LDAP's default TCP application port is 389.
- If necessary, choose the LDAP version. The default is V3; you may choose V2 if the LDAP server supports only that version.
- Click Save to save your configuration.
- Click Cancel to close the dialog.
To assign the LDAP service's remote groups with NetMRI's local roles, do the following:
...
1. Click the Remote Groups tab.
- In the Remote Group field, enter the name of a new remote group for the authentication service. In these steps, you are mapping this group name to the NetMRI Role(s) and device group(s).
- Choose the Role for the new remote group. (For information, see Defining and Editing Roles.)
- Check the check boxes for the device groups you want to allow for the remote group. Note that the SysAdmin role applies to all device groups. Other roles allow selection of individual device groups.
- Click OK to complete the configuration.
- When finished with the remote group configuration, click Save and then Close. Note that you can add multiple Roles for the remote group.
- Click Test to test the server settings. Enter a valid username and password. A successful test returns the list of groups to which the test user belongs.
| Anchor | ||||
|---|---|---|---|---|
|
...
When you test the connection to the server, your NetMRI-to-LDAP server connections (or for Active Directory connections) allow for loading a current SSL certificate from a .PEM file. (See the section [<span style="color: #0000ff"><em>NetMRI</em></span> <span style="color: #0000ff"><em>Security</em></span> <span style="color: #0000ff"><em>Settings</em></span>|Introduction#bookmark51] for the process of adding SSL certificates to NetMRI.) This certificate automatically appears in the authentication server's *Certificate* drop-down menu after being loaded into NetMRI: An LDAP connection test shows the following: Username: section NetMRI Security Settings for the process of adding SSL certificates to NetMRI.) This certificate automatically appears in the authentication server’s Certificate drop-down menu after being loaded into NetMRI:
An LDAP connection test shows the following:
Username: ******
...
Password:******
...
Process
...
Started
...
2015-05-01
...
17:41:59
...
------------------------------------------------------
...
2015-05-01
...
17:41:59
...
+++
...
BEGIN
...
testing
...
access
...
to
...
authentication
...
servers
...
+++
...
2015-05-01
...
17:41:59
...
+++
...
LDAP
...
connection:
...
username='jsmith',
...
address='ldaps://172.16.23.2',
...
port='636',
...
certPath='/var/local/netmri/certs/ca_repo/1430516467.501615.pem'
...
,
...
version
...
='',
...
timeout='5'
...
+++
...
2015-05-01
...
17:41:59
...
Anonymous
...
bind
...
2015-05-01
...
17:41:59
...
Authentication
...
successful.
...
2015-05-01
...
17:41:59
...
Authenticate
...
user
...
'cn=jsmith,ou=People,dc=corp100,dc=com'
...
with
...
'inet6
...
=>
...
Y'...
...
2015-05-01
...
17:41:59
...
Authentication
...
successful.
...
2015-05-01
...
17:41:59
...
Groups:
...
['administrators',
...
'dev'
...
]
...
2015-05-01
...
17:41:59
...
+++ END
...
testing
...
access
...
to
...
authentication
...
servers +++
...
2015-05-01
...
17:41:59
...
------------------------------------------------------
...
Authentication
...
Test
...
Completed
...
If you set the *Encryption* menu to *None{*}, this option remains unavailable, and authentication tests will show a blank
certPath value in the test output.
\\
| Anchor | ||||
|---|---|---|---|---|
|
Should you have a provisioned Bind User DN (Distinguished Name) and Bind Password needed for the LDAP service, perhaps for a power user, or in cases where anonymous access is not granted by policy, you can use those values to provide another level of security between NetMRI and the servers comprising the LDAP service.
An anonymous bind takes place as follows:
2015-05-01 17:41:59 Anonymous bind 2015-05-01 17:41:59 Authentication successful.
An authenticated bind, using the correct Bind User DN and Bind Password appears as follows:
2015-05-01 18:23:06 Authenticate 'cn=root,dc=infoblox,dc=com' 2015-05-01 18:23:06 Authentication successful.
| Anchor | ||||
|---|---|---|---|---|
|
| Anchor | ||||
|---|---|---|---|---|
|
RADIUS (Remote Authentication Dial-In User Service) provides authentication, accounting, and authorization functions, through a communications stream between clients and a dedicated server. NetMRI directly supports authentication and authorization using FreeRADIUS; other widely used RADIUS implementations include GNU RADIUS and Microsoft IAS. RADIUS provides all user authentication in a single centralized database. After users are verified, they have access to any NetMRI administrative function permitted for their account.
| Anchor | ||||
|---|---|---|---|---|
|
| Anchor | ||||
|---|---|---|---|---|
|
Configuring the RADIUS Service requires knowledge of the following key values:
...
Note: You can change the Infoblox Vendor ID and Vendor Attribute values in your configuration, but ensure that you declare the same value in the external dictionary file on the RADIUS server. Infoblox recommends retaining the default values.
...
To configure the authentication service's RADIUS servers, do the following:
...
1. Click the Servers tab.
- Click Add to add RADIUS servers to the service. The Add Authentication Server dialog opens.
- Enter the Host/IPAddress.
- Choose the SharedSecret for the RADIUS server.
- If necessary, enter the Port value. RADIUS's default UDP application port is 1812.
- Click Save to save your configuration.
- Click Cancel to close the dialog.
To assign the RADIUS service's remote groups with NetMRI's local roles, do the following:
...
1. Click the Remote Groups tab.
- In the Remote Group field, enter the name of a new remote group for the authentication service. In these steps, you are mapping this group name to the NetMRI Role(s) and device group(s).
- Choose the Role for the new remote group. (For information, see Defining and Editing Roles.)
- Check the check boxes for the device groups you want to allow for the remote group. Note that the SysAdmin role applies to all device groups. Other roles allow selection of individual device groups.
- Click OK to complete the configuration.
- When finished with the remote group configuration, click Save and then Close. Note that you can add multiple Roles for the remote group.
- Click Test to test the server settings. Enter a valid username and password. A successful test returns the list of groups to which the test user belongs.
| Anchor | ||||
|---|---|---|---|---|
|
| Anchor | ||||
|---|---|---|---|---|
|
The RADIUS server or servers require the following additional configurations to inter-operate with NetMRI:
...
When you configure your RADIUS server files to support the Infoblox attributes, you can use modifiable RADIUS service parameters to support Infoblox features. On a basic level, the Infoblox Vendor ID (7779) and Vendor Attribute ID (10) values reflected in the following example should not be changed. Other RADIUS service parameters and attributes are described in this section. All examples use FreeRADIUS syntax, but many other RADIUS server types follow similar principles.
You must configure the RADIUS server to allow the NetMRI connection. To do so, the administrator adds the appliance IP address to the configuration, and defines a shared secret. in the case of FreeRADIUS, you add an entry in the
/etc/raddb/clients.conf file (this example shows IPv4 and IPv6 entries):
#Allow NetMRI
client 172.16.1.23/24 {
secret = #$*&@#$!
shortname = netmri
}
client 2001::db8:56ff:feb8:875c/96 {
secret = #$*&@#$! shortname = ipv6_netmri
}
The FreeRADIUS server uses a primary dictionary file in its main /etc/raddb directory. A reference to an external dictionary file, such as dictionary.infoblox, should be added as follows:
$INCLUDE dictionary.infoblox
You can declare the custom attribute using any name, but references must be consistent in the rest of the server configuration files that you create.
To support the custom dictionary, create a new text file named dictionary.infoblox in the /etc/raddb directory, containing the following Vendor ID value and attribute ID number:
# Add a new vendor and specific attribute to store the group value, and add into the answering Access-Accept packet VENDOR infoblox 7779
...
ATTRIBUTE NA-group-
...
info 10 string infoblox
This declaration in the new dictionary file supports the default values that are reflected in the Add Authentication Service dialog in NetMRI when you configure a new RADIUS service. As previously noted, you can use whichever values you want, but those values must be correctly applied throughout the configuration.
Finally, for a query from the NetMRI appliance about a valid user/password, the Radius administrator must ensure that a response will contain the 'na-group-info' attribute with the list of groups' names of which the user is a member.
| Anchor | ||||
|---|---|---|---|---|
|
| Anchor | ||||
|---|---|---|---|---|
|
| Anchor | ||||
|---|---|---|---|---|
|
To support TACACS+ authentication and authorization through NetMRI, you configure a custom service,
infoblox, on the T+ server, and then define the user names and group names in the infoblox service's custom attribute na-group. (These services and attributes can be named differently according to preference; we use these values by convention in this document.)Ensure that you apply each user group to the custom service
infoblox (or however you choose to name the custom service). On NetMRI, you add the remote groups with the same names to the authentication service. When the TACACS+ server responds to an authentication and authorization request relayed from NetMRI and the response includes the na-group custom attribute, NetMRI matches the group name with the group in the authentication service and automatically assigns the admin to that group.If you will use T+ only for authentication, the user accounts must all be defined in NetMRI with the User DIs matching the declared values on the T+ server. These accounts must be locally configured on NetMRI with the roles assigned to their specified device groups.
If you will use T+ for both authentication and authorization, and the configurations are done in the T+ server configuration file, the successfully authenticated and authorized users will be dynamically created in NetMRI with the roles defined through the configurations in the Authentication Service configured in NetMRI.
| Anchor | ||||
|---|---|---|---|---|
|
| Anchor | ||||
|---|---|---|---|---|
|
User authentication support in TACACS+ requires each user account to be defined in NetMRI with their defined User ID matching their declared value on the TACACS+ server.
For authorization settings, the T+ configuration file contains the group definitions and the relationships of each user account to those groups.
Configuring the TACACS+ Service requires knowledge of the following key values:
- The
na-group-infogroup attribute value defined for NetMRI in the TACACS+ configuration; - The IP address of the TACACS+ server;
- The shared secret for authenticating the NetMRI appliance on the TACACS+ server;
- The port number (normally, you will retain the default value 49).
- The names of the remote groups on the LDAP server containing the users intended to log in to the NetMRI appliance.
On NetMRI, for the TACACS+ authentication service, you define remote groups with the same names (test_admin_group, for example – the group names could be any preferred text string), and the roles these users can have in the specified device groups. When the TACACS+ server responds to an authentication and authorization request relayed from NetMRI, the response includes the group name. If NetMRI does not find a matching remote group in the authentication service, it will not allow the user to log in and will try the following service in its authentication services list.
To configure a TACACS+ authentication service for NetMRI, do the following:
...
Note: If the authentication server or its shared secret is incorrect, the message "Unable to get access information" will appear.
...
If the test user name or password is incorrect, access is rejected. Access will also be rejected if no NetMRI Role is defined for the test user, on the NetMRI system.
8 . You can elect to use TACACS+ only for authentication. In such cases, check the Disable authorization check box.
- If you wish to disable the current service check the Disable service check box.
To configure the authentication service's TACACS+ servers, do the following:
...
1. Click the Servers tab.
- Click Add to add TACACS+ servers to the service. The Add Authentication Server dialog opens.
- Enter the Host/IP Address.
- Choose the Shared Secret for the server.
- Choose the Priority for the new server in the authentication service. In this context, the priority value determines the order of which servers in the service are queried by NetMRI. A lower value number denotes a higher priority. "1" is the highest possible priority. Only one server should have a "1" priority.
- If necessary, enter the Port value. The TACACS+ default application port is 49.
- Click Save to save your configuration.
- Click Cancel to close the dialog.
To assign the TACACS+ service's remote groups with NetMRI's local roles, do the following:
...
1. Click the Remote Groups tab.
- In the Remote Group field, enter the name of a new remote group for the authentication service. In these steps, you are mapping this group name to the NetMRI Role(s) and device group(s).
- Choose the Role for the new remote group. (For information, see Defining and Editing Roles.)
- Check the check boxes for the device groups you want to allow for the remote group. Note that the SysAdmin role applies to all device groups. Other roles allow selection of individual device groups.
- Click OK to complete the configuration.
- When finished with the remote group configuration, click Save and then Close. Note that you can add multiple Roles for the remote group.
- Click Test to test the server settings. Enter a valid username and password. A successful test returns the list of groups to which the test user belongs.
Subsequent login attempts are authenticated using the defined authentication servers (except for the admin user account).