aaa authentication

Usage Guidelines

This command selects the order of authentication sources to be used for user authentication during the login process. Three sources of authentication are supported, primary, secondary, and tertiary. The secondary and tertiary authentication sources are optional. They are only used if they are configured and the preceding authentication source fails or is not reachable.

Note

Configuring secondary source of authentication is optional. Configuring tertiary source is also optional, however, it can only be configured when a secondary source is also configured.

Note

Fallback to the next authentication source will only happen if the previous authentication server is not available or not reachable. Fallback will not happen if the previous authentication server is available to authenticate and if wrong credentials are passed to it or if the server rejects the parameters passed to it for other reasons.

Caution

SSH imposes an immutable timeout of 120 seconds. Administrators should be aware that all authentication must complete within this time period.

It is recommended that retries and timeouts for the authentication servers be configured in a way that the authentication process (including fallback) completes within SSH's timeout value of 120 seconds.

For example, let us assume that there are five (5) servers configured for the primary authentication and five (5) servers for the secondary authentication. While authentication happens, connection will be tried to first primary server for the configured retry attempts for that server. If the server is unreachable, the next server in the list will be tried for the configured retry attempts. This process will be repeated till, either, one of the servers respond or all servers timeout. During this process of testing the various servers, there is a possibility that the SSH's timeout value is exceeded. Due to this, fallback to the next authentication method might not happen and your authentication may fail.

Authentication modes can only be set and cannot be added or deleted. For example, to change a configuration from radius local to radius only, execute the no aaa authentication login command to resets the configuration to the default mode, and then reconfigure the AAA mode with the desired setting.

Similarly, in a configuration with primary and secondary sources of authentication, the primary mode cannot be modified alone. For example, you cannot change from radius local or radius ldap-auth-fallback local-auth-fallback to tacacs+ radius-auth-fallback or tacacs+ local local-auth-fallback respectively. First remove the existing configuration and then configure it to the required configuration.

However, in a configuration where the primary and secondary sources of authentication are configured, it is possible to change the secondary source without using the no aaa authentication login command. For example, if you want to change the existing configuration from radius tacacs+ to radius ldap, then issue the command aaa authentication login radius ldap directly.

With OAuth2 authentication, the log-in request from the north-bound interface uses the OAuth2 token as a password. The device authenticates the user based on the validity of the OAuth2 token.

Also, for OAuth2 authentication only, both the local and local-auth-fallback options allow fallback to the local database if the secondary source of authentication is configured as local or local-auth-fallback. In this scenario, they behave in the same manner.

If login fails through the primary source because none of the configured servers respond or the login is rejected by the server, authentication is done again through the secondary source or local option. If the authentication using the secondary source also fails, then local-auth-fallback is used if configured.

When “local-auth-fallback” option is specified as the tertiary option, local authentication is tried only when the primary and the secondary AAA authentication service are either “unreachable” or “not available”. Unlike the “local” option, local authentication is not be attempted if the authentication with primary or secondary service fails.

Use the no form of the command to restore the authentication mode to local mode.