AAA - Login with Centralized Authentication HowTo

About

This document aims to show how to set up an AAA method in the system with centralized authentication, and how it is connected to the login service.

For an overview of all available configuration settings for AAA refer to the configuration guide:

• AAA Configuration Guide

Introduction

Centralized authentication can be used to simplify account administration, this holds especially true when networks grow in size. Instead of manually adding each user and its credentials to each device, the device itself can be instructed to ask a remote server if the provided user information is valid and should provide access.

Support exist in the system for three different types of remote authentication protocols, RADIUS (Remote Authentication Dial-IN User Service), TACACS+ (Terminal Access Controller Access-Control System Plus), and LDAP (Lightweight Directory Access Protocol).

RADIUS and TACACS+ are client/server protocols that host a database of usernames and associated credentials on the server. The client forwards provided credentials to the server to verify if they are valid.

LDAP is a directory-access protocol used to look up and authenticate users against a central directory service, such as OpenLDAP or Active Directory®. The device binds to the LDAP server using a service account (bind DN) and searches for the user entry to authenticate.

Currently the device can only act as a client, no support exist to serve as a server for any of the protocols.

Configure

This section will cover how to configure a remote server AAA method and how to connect it to the login service.

Remote Server

When a central authentication server is defined in the system, a numeric ID is provided that will be associated with it. This ID will be used when mapping this specific method to a service with AAA support, e.g. the login service. The following examples shows how to create remote-server method using unencrypted RADIUS and encrypted RADIUS (peap-mschapv2):

example:/#> configure
example:/config/#> aaa
example:/config/aaa/#> remote-server 1
Creating new remote server 1
example:/config/aaa/remote-server-1/#> password RADiuSseCret
example:/config/aaa/remote-server-1/#> address 192.168.1.1
example:/config/aaa/remote-server-1/#> type radius
example:/config/aaa/remote-server-1/#> message-authenticator false
example:/config/aaa/remote-server-1/#> auth-port 1812
example:/config/aaa/remote-server-1/#> end
example:/config/aaa/#>

example:/#> configure
example:/config/#> aaa
example:/config/aaa/#> remote-server 1
Creating new remote server 1
example:/config/aaa/remote-server-1/#> password RADiuSseCret
example:/config/aaa/remote-server-1/#> address 192.168.1.1
example:/config/aaa/remote-server-1/#> type radius
example:/config/aaa/remote-server-1/#> encryption-type peap-mschapv2
example:/config/aaa/remote-server-1/#> ca-cert servercertlabel
example:/config/aaa/remote-server-1/#> auth-port 1812
example:/config/aaa/remote-server-1/#> end
example:/config/aaa/#>

Notes on the configurations:

• The provided address is the location of the RADIUS server, with its associated password required for access to the server.

• The type of remote server is specified as a RADIUS server. The auth-port is also configured to the RADIUS default port 1812.

• The available encryption-type of remote server depends on the protocol. Classical and unencrypted authentication can be specified with encryption-type none.

• Depending on protocol, server and client node authentication can be done with certificates/pfx:es. These packages are imported with the normal certificate function and referenced trough their label.

• Validation of the RADIUS protocol attribute "message authenticator" can be turned off for non-encrypted RADIUS. It is mandatory for RADIUS that uses EAP. Default is on. You can disable validation when working with less secure/older RADIUS servers.

In case the desired method is to use TACACS+ instead, simply change the type and the auth-port:

example:/config/aaa/#> remote-server 1
example:/config/aaa/remote-server-1/#> type tacacs
example:/config/aaa/remote-server-1/#> auth-port 49
example:/config/aaa/remote-server-1/#> end
example:/config/aaa/#>

LDAP

To use LDAP, set the type to ldap. Only one LDAP server entry can be configured, with a primary address and an optional secondary address for failover. Unlike RADIUS and TACACS+, LDAP uses a bind DN and password (service account) to search the directory, rather than forwarding user credentials directly to the server.

warning

Unencrypted LDAP transmits all data — including user passwords — in plain text over the network. Use ldaps or ldap-starttls encryption in production environments.

The following example shows how to configure a basic unencrypted LDAP server against an Active Directory® domain:

example:/#> configure
example:/config/#> aaa
example:/config/aaa/#> remote-server 0
Creating new remote server 0
example:/config/aaa/remote-server-0/#> type ldap
example:/config/aaa/remote-server-0/#> description adserver
example:/config/aaa/remote-server-0/#> no connection-security
example:/config/aaa/remote-server-0/#> primary-address 192.168.1.10
example:/config/aaa/remote-server-0/#> secondary-address 192.168.1.11
example:/config/aaa/remote-server-0/#> no auth-port
example:/config/aaa/remote-server-0/#> bind-dn cn=ldap-reader,ou=service-accounts,dc=corp,dc=com
example:/config/aaa/remote-server-0/#> bind-password S3rviceAccP@ss
example:/config/aaa/remote-server-0/#> base-dn dc=corp,dc=com
example:/config/aaa/remote-server-0/#> user-id-mapping sAMAccountName
example:/config/aaa/remote-server-0/#> no role-base-dn
example:/config/aaa/remote-server-0/#> search-filter (objectClass=user)
example:/config/aaa/remote-server-0/#> role-map administrator NetworkAdmins
example:/config/aaa/remote-server-0/#> role-map operator NetworkOps
example:/config/aaa/remote-server-0/#> end
example:/config/aaa/#>

If we want to use a FQDN we could configure something like:

example:/config/dns/#> show
ADDRESS          NAME             FQDN                                        
192.168.1.10                      myserver.com

To use LDAP over SSL (LDAPS) or with STARTTLS, set the connection-security accordingly and supply a CA certificate label. Optionally, a client certificate can be provided for mutual TLS authentication:

example:/config/aaa/#> remote-server 0
example:/config/aaa/remote-server-0/#> type ldap
example:/config/aaa/remote-server-0/#> description adserver
example:/config/aaa/remote-server-0/#> connection-security ldaps
example:/config/aaa/remote-server-0/#> ciphers-tls1.2 TLS_CHACHA20_POLY1305_SHA256
example:/config/aaa/remote-server-0/#> ciphers-tls1.3 TLS_AES_128_GCM_SHA256
example:/config/aaa/remote-server-0/#> elliptic-curve-only Off
example:/config/aaa/remote-server-0/#> ca-cert my-ca-cert
example:/config/aaa/remote-server-0/#> no client-cert my-client-cert
example:/config/aaa/remote-server-0/#> no revocation
example:/config/aaa/remote-server-0/#> primary-address ldap.corp.com
example:/config/aaa/remote-server-0/#> auth-port 10636
example:/config/aaa/remote-server-0/#> bind-dn cn=ldap-reader,ou=service-accounts,dc=corp,dc=com
example:/config/aaa/remote-server-0/#> bind-password S3rviceAccP@ss
example:/config/aaa/remote-server-0/#> base-dn dc=corp,dc=com
example:/config/aaa/remote-server-0/#> user-id-mapping sAMAccountName
example:/config/aaa/remote-server-0/#> search-filter (objectClass=user)
example:/config/aaa/remote-server-0/#> end
example:/config/aaa/#>
example:/config/aaa/#> credential-cache On
example:/config/aaa/#> credential-cache-expiry 7d

When using a certificate it is important that the primary-address is written in the certificate's SAN field. The certificate might have one or more IP addresses or a FQDN's in the SAN field and one of them should be used as a primary address for the LDAP server.

For OpenLDAP, use uid as the uid-mapping attribute and an appropriate base-dn and search-filter:

example:/config/aaa/#> remote-server 0
example:/config/aaa/remote-server-0/#> type ldap
example:/config/aaa/remote-server-0/#> primary-address 10.0.0.5
example:/config/aaa/remote-server-0/#> bind-dn cn=reader,dc=example,dc=com
example:/config/aaa/remote-server-0/#> bind-password ReaderPass
example:/config/aaa/remote-server-0/#> base-dn ou=users,dc=example,dc=com
example:/config/aaa/remote-server-0/#> role-base-dn ou=groups,dc=example,dc=com
example:/config/aaa/remote-server-0/#> user-id-mapping uid
example:/config/aaa/remote-server-0/#> search-filter (objectClass=inetOrgPerson)
example:/config/aaa/remote-server-0/#> end
example:/config/aaa/#>

Notes on the LDAP configuration:

• ciphers-tls1.2 List of TLS 1.2 cipher suites to include in cipher negotiation between clients and servers.

• ciphers-tls1.3 List of TLS 1.3 cipher suites to include in cipher negotiation between clients and servers.

• elliptic-curve-only Enable or disable use of elliptic curve for key exchange.

• primary-address (required) and secondary-address (optional fallback) replace the address command used for RADIUS and TACACS+. When using a CA certificate, the primary address must be in the certificate. To test making a client certificate we can created a certificate using the LDAP server certificate:

  1. Create client key and a certificate request (no password and return on all questions)
     openssl req -newkey rsa:2048 -days 365000 -nodes -keyout client-key.pem -out client-req.pem
  2. Create client certificate
     openssl x509 -req -in client-req.pem -days 365000 -CA ldap.crt -CAkey ldap.key -set_serial 01 -out client-cert.pem
  3. Check we got the right ISSUER with:
     openssl x509 -in client-cert.pem -noout -text
  4. Check CA can validate client with:
     openssl verify -CAfile ldap.crt client-cert.pem
  5. Import the client and CA certificates into WeOS5.

• bind-dn and bind-password are the credentials of the service account used to search the directory. The service account should have read-only access to the user entries.

• base-dn defines the starting point in the directory tree for user lookups. e.g. start searching from this point.

  • role-base-dn (optional) defines the DN suffix that a role-map's remote LDAP role is combined with when matching group membership. If role-base-dn is set to ou=groups,dc=example,dc=com and a role-map remote role is westermo_admin, the user must be a member of the LDAP group with DN CN=westermo_admin,ou=groups,dc=example,dc=com. Without role-base-dn, matching is done by CN only, regardless of its position in the LDAP tree.

  • user-id-mapping specifies which LDAP attribute holds the username. Use uid for OpenLDAP and sAMAccountName for Active Directory® (default).

• role-base-dn (optional) defines the DN that a role-map remote role must have. If role-base-dn is specified as ou=groups,dc=example,dc=com and the role-map remote role is specified as westermo_admin the users must be a memberOf westermo_admin/groups/example.com in the LDAP server.

• uid-mapping specifies which LDAP attribute holds the username. Use uid for OpenLDAP and sAMAccountName for Active Directory® (default).

• search-filter narrows the search to matching entries. Parentheses are added automatically if omitted.

• role-map maps a local device role (e.g. administrator, operator) to an LDAP group DN. Multiple role maps can be configured. Users not matched by any role map will be denied access.

• For ldaps, the default port is 636. For ldap-starttls and plain ldap, the default port is 389.

• When using ldaps or ldap-starttls, a CA certificate (ca-cert) must be imported into the PKI store and referenced by its label. Optionally, a client certificate (client-cert) can be configured for mutual TLS. The CA certificate is typically the LDAP servers public certificate.

• Only one LDAP server entry can be configured, with a primary and an optional secondary address for failover. LDAP servers cannot be added to server groups. The remote-server should be added to an authentication chain e.g.:

example:/config/aaa/#> auth-chain
example:/config/aaa/auth-chain/#> show
Order          : server-0 
Local fallback : always
On-reject      : next

Troubleshoot LDAP with ldap-debug

The ldap-debug command tests the first LDAP server in the AAA authentication chain. It uses the server's configured address, port, encryption settings, bind DN, password, base DN, search filter, UID-mapping attribute, and certificates.

From the aaa exec context, run the command with an optional LDAP username:

example:/#> aaa
example:/aaa/#> ldap-debug [USERNAME]

The command checks TCP connectivity, the LDAP connection and RootDSE, the configured bind credentials, and the configured base DN search. When a username is supplied, it also searches for the user and displays its memberOf groups to help verify the WeOS role mapping. For StartTLS and LDAPS, the command performs additional TLS certificate checks when a CA certificate is configured.

Examples:

example:/aaa/#> ldap-debug
example:/aaa/#> ldap-debug alice

Troubleshoot LDAP with query-ldap-server

The query-ldap-server command makes it possible to query the configured LDAP server to test connectivity. Bind credentials and uid attributes are taken from the configured LDAP server.

example:/aaa/#> query-ldap-server
example:/aaa/#> 
Syntax:
	query-ldap-server [user <USERNAME>] [filter <FILTER>] [base <BASE-DN>] [scope <base|one|sub>] [ATTR ...]

Example:
	query-ldap-server user jdoe
	query-ldap-server user jdoe memberOf
	query-ldap-server user jdoe filter "(memberOf=cn=admins,dc=corp,dc=com)"
	query-ldap-server filter "(cn=John*)" cn memberOf

This tool is used to send queries when we know we have a valid connection to the LDAP server.

Server Group

If multiple different remote servers are utilised for redundancy purposes (both servers have identical user databases and are of the same type) they can be added to a server group.

For tacacs and radius groups the behavior is:

• If the device gets a response from one server (accept or reject), it will not try the other server(s) in the server group.

• If the request sent to one server times out, it tries to send the request to the next server. This goes on until a response is received or until all servers in the groups have been tried.

• A current limitation for radius servers. If multiple radius servers in a radius group contain different settings for message-authenticator, only the setting from the first server in the server group will be used.

For encrypted-radius groups the behavior is:

• If the request gets accepted by one server, it will not try the other server(s) in the server group.

• If the request times out or is rejected, it tries to send the request to the next server. This goes on until a accept is received or until all servers in the groups have been tried.

When a server group is defined in the system, a numeric ID is provided that will be associated with it. This ID will be used when mapping this specific method to a service with AAA support, e.g. the login service. Creation of a server-group is carried out as follows:

example:/#> configure
example:/config/#> aaa
example:/config/aaa/#> remote-server 1
Creating new remote server 1
example:/config/aaa/remote-server-1/#> password RADiuSseCret
example:/config/aaa/remote-server-1/#> address 192.168.1.1
example:/config/aaa/remote-server-1/#> type radius
example:/config/aaa/remote-server-1/#> auth-port 1812
example:/config/aaa/remote-server-1/#> end
example:/config/aaa/#> remote-server 2
Creating new remote server 2
example:/config/aaa/remote-server-2/#> password RADiuSseCret2
example:/config/aaa/remote-server-2/#> address 10.0.1.1
example:/config/aaa/remote-server-2/#> type radius
example:/config/aaa/remote-server-2/#> auth-port 1812
example:/config/aaa/remote-server-2/#> end
example:/config/aaa/#> server-group 1
Creating new server group 1
example:/config/aaa/server-group-1/#> server 1,2
example:/config/aaa/server-group-1/#> type tacacs
example:/config/aaa/server-group-1/#> end

Attach to login service

In order to configure the login service to authenticate users logging in against a remote-server, the ID of the created method needs to be supplied in the following manner:

example:/config/aaa/#> auth-chain
example:/config/aaa/auth-chain/#> order server-1
example:/config/aaa/auth-chain/#> end
example:/config/aaa/#>

Any login attempt to the device will try to authenticate against the configured server. If the request sent to the server results in reject or timeout, the device falls back to using the built-in accounts (e.g. the admin account).