18-46
User
Guide

for

the

Cisco

Application

Networking

Manager

5.2
OL-26572-01
Chapter
18






Administering

the

Cisco

Application

Networking

Manager
Using
an

AAA

Server

for

Remote

User

Authentication

and

Authorization
ANM_UniqueID=
RoleName<space>Domain1<space>Domain2

.

.

.
ANM/IP
should

be

used

as

t

he

TACACS_Service/TACACS_Protocol

pair

for

an

authorization
request
and

response.

•
You
configure

the

user

authorization

attributes

on

the

TACACS+

server

using

the

following

format:
ANM_UniqueID=
RoleName<space>Domain1<space>Domain2

.

.

.
The
number

of

characters

allowed

for

the

ANM

identifier,

role,

and

domain

information

is

limited
to
160

characters,

including

spaces.

Y
ou

can

use

additional

characters

by

adding

a

ne
w
ANM

Unique
ID
entry

for

domain

attributes

as

follows:
ANM_UniqueID_1=RoleName<space>Domain1<space>Domain2
ANM_UniqueID_2=Domain3<space>Domain4
ANM_UniqueID_3=Domain5
You
must

assign

a

different

ANM

identifier

to

each

entry.

Make

sure

that

you

configure

the

ANM
organization
with

each

ANM

uni

que

ID

(see

the

“Adding

a

New

Organization”

section

on
page
18-10 ).

•
You
can

define

user

authorization

at

the

user

level,

user

group

level,

or

both.

We
recommend
configuring
authorization

at

the

user

group

level,

which

al

lows

you

to

assi

gn

a

common

set


of
authorization
attributes

to

multiple

users.

When

you

configure

the

authorization

attributes

at

both
the
user

level

and

user

group

level,

the

user

attributes

take

precedence

over

user

group

attributes.
The
pr

ocedure

in

t

his

section

includes

all

t

hree

configuration

options.

•
You
can

configure

ANM

to

revert

to

local
user

authorization

if

the

TACACS+

server

becomes
unavailable
(see

the

“Adding

a

New

Organization”

section

on

pa

ge

18-10 ).
Prerequisites
ANM
has

a

user

organization

that

is

configured

for

remote

authorization

(see

the

“Adding

a

New
Organization”
section

on

page

18-10 ).
This
section

includes

the

following

topics:

•
Configuring
Remote

User

Authorization
Using
Cisco
Secure

ACS

Version

5.1,

page
18-46

•
Configuring
Remote

User

Authorization
Using
Cisco
Secure

ACS

Version

4.2,

page
18-48
Configuring
Remote

User

Authorization

Using

Cisco

Secure

ACS

Version

5.1
You
can

use

Cisco

Secure

ACS

Version

5.1

for

configuring

a

re

mote

server

to

perform

remote
authorization
of

ANM

users.
Note
This
procedure

describes

only

the

ANM-specific

attributes

for

creating

user

groups

and

users

on

Cisco
Secure
ACS.

For

information

about

configuring

the

other

attributes,

see

the

User

Guide

for

Cisco

Secure
Access
Control

Server

located

on

Cisco.com .
Procedure
Step
1
From
the

Cisco

Secure

ACS

HTML

GUI,

create

a

new

Device

Type

to

identify

requests

coming

from

the
ANM
server.