ACS 5.3 - privilege of user group

Similar Questions

• Several downloadable ACLs by ACS user group

  It is possible to map several downloadable ACLs to a single user or group of users use ASA and ACS?

  For example, you have an ACL controlling access to servers (ACL A) and another ACL (ACL B) internet access. Is it possible to assign several ACL to a group of users, such as user group can only access the servers, while the user group B can access servers and internet (ACL A + B ACL)?

  Thank you and best regards.

  George,

  The user and group settings only would allow you to select only a single instance of DACL list at once.

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a0080a9eddc.shtml#configuringtheserverwitfddhias

  Kind regards

  Jousset

  The rate of useful messages-

• ACS 4.1 engine lists NT but not the NT users groups

  Hello

  I have the following problem. I can access using remote agent Win NT ad groups but the GBA engine does not list users in groups after ACS group mapping. What could be the problem?

  AD runs on Win 2 K sp4.

  Hello

  ACS does not list the user in the groups until you do 1st authentication with this user.

  Then ACS will list the user as a user "mapped Dynamics" in this group.

  Concerning

  Rohit Chopra

• Level of different privilege for users Active directory

  Hello

  We have integrated the Acs 4.1se with directory.now active windows, must be given some full privige of users some client devices, and show only level privilege to some devices.what is that the steps required in ACS and ACS customers. Also how long dynamic users will stay in ACSthanks in advance

  Also in acs an aaa client or user may not be a part of the group then one more.

  Kind regards

  ~ JG

• A single user - groups - ACS4.2

  Hi all

  Is it possible that one of the AD user who is already a member of several groups in AD, can work the same way with 4.2 ACS? In fact, my client has created several groups on AD such as TI-group, Corp. - and VIP-group, and these groups are mapped to the ACS. Now we are authenticating users with SSID for the wireless network by creating NAR which corresponds DNIS (SSID is identical to ad groups). Some users are members of all the groups of 3 or 2, but we observed the user who is a member of the groups of 2 or more is always authenticated with the 1 group that is located on the ACS. This is the limitation of ACS4.2?

  Kind regards

  Sohail

  Please understand this example:

  For example, a user named Mary is assigned to the combination of three groups, Marketingand engineering managers. Mary must be granted the privileges of a manager rather than an engineer.

  -Mapping A assigns to ACS Group 2 users who belong to three groups which Mary is a member.

  -B mapping attributes to ACS Group 1 users who belong to the engineering and marketing groups.

  -Mapping C assigns to ACS Group 3 users who belong to the engineering group.

          ACS GROUP     AD EXTERNAL GROUP
  A.    Group 2              Engineering, Marketing and Managers
  B.   Group 1              Engineering, Marketing
  C.   Group 3              Engineering
  - If Mapping B is listed first, ACS authenticates Mary as a user of Group 1 and she is be assigned to Group 1, rather than Group 2 as managers should be.
  - A user must match all the groups in the Selected list so that ACS can use this group set mapping to map the user to an ACS group; however, a user can also belong to other groups (in addition to the groups listed) and still be mapped to an ACS group.
  - Order of group mapping is very important.
  

  Now, please let me know if you have any other requirement.

  ~ BR
  Jatin kone

  * Does the rate of useful messages *.

• ACS same username with two other group, two profiles of shell

  Hello

  In my ACS 5.4 I want to have same useranme using two profiles of shell. This is the requirement.

  Profile of a shell with privileges for admin peripheral IOS 15 and another with different privilege admin WCS. Because there may be two profiles of shell on the same profile authroization, I created two different profiles and correspondence with the name of the local group of ACS. However, whenever the user tries to access it always hits 1 profiles.

  I'm not sure that I missing something, if someone has or knows how to do this please advise.

  Thank you

  Hello

  What you can do is to create two authorization rules based on the ip address.

  Use two rules:

  rule 1: If the ip address is wcs ip address then use WCS-Shell-profile

  rul3 2: If the ip address of the device do not match the wcs ip address then use: other-Shell-profile

  If you don't see the ip address in the rule options, you can always customize what options you want to compare from the button customize at the bottom right of the page.

  HTH

  Amjad

  Rating of useful answers is more useful to say "thank you".

• AAA RADIUS authentication for the only user group

  Hello

  I use ACS3.1 and tries to use authentication radius for all network switches in my company.

  Meet the im problem now is how to restrict only a user group to access the connection/exec switches? It seems that all user IDS in my acs able to telnet (user access) to the switch (using their login credentials).

  I would like to limit still from telnet by using their ID except administrator group.

  Counsel on how this is possible.

  TKS!

  The GBA, you need admin users in their own ACS group separated, leaving other users in their own group also.

  Change the group that contains the users you don't want to give access to and under the heading of restricted access network (OAN), in "Group defined Network Access Restrictions", check the "Define based on IP access restrictions", choose "Rejected the call point" and enter switches in the table below (put a * in the port and address).

  This prevents standard users authentication to switches. You can add all your switches in a group of network devices (NDG) to this, then you have to add that, in the section NAR rather than adding each switch individually.

• Secondary ACS authenticates not to dynamic users

  Hi all

  I have two ACS server for windows with version 4.2. My problem is that, if the primary ACS server is down, dynamic users from the database windows in unable to authenticate with the ACS secondary. Please note that if a user is added to the ACS, this user can authenticate with the windows database. Only the dynamic mapping is not the case with the second ACS server.

  A quick response will be appreciated.

  What is in the database of Windows in both the points of the unknown user policy? Dynamic users are active under the unknown user policy?

  Are these servers ACS for Windows or the ACS SE with a Remote Agent installed on a member of the AD Server?

  If they are remote Agents, see the external database > Windows Configuration > selection of the Remote Agent. The same remote Agent is selected on both ACS servers?

  Please be aware that if you change the order of the RA he would remove all your group mappings.

• MAXL Script to retrieve a specific user groups

  Hello

  Is it possible to retrieve a specific user groups? I'm trying to get groups using command maxl "disply user to the Group groupname." But he plurarite of all groups and users. I don't want that group belongs to the specific user.

  Thank you

  Michel K

  No, I don't think you can.  "View user" won't do, 'The display Privilege' won't, 'View group' won't.  The best that you could do with MaxL exited the membership of all the groups and then parse the output to display only the user that you want.

• Managing Director and structures not dishes user/group

  Hello, I am trying to build a directory structure with several containers under an organization allowing to memorize the different portions of userdata and group data (i.e. not only UO = unit of organization and people = group, but also a few UO like them). Server software is 7u2 OUCS release. Users in 'other' containers are filled in LDAP (ODSEE 11) by replication, filling the same attributes as a freshly created account by DA has.
  
  The delegated administration interface and other parts of the software accept this and work well with this configuration, the user information display, which allows connections and so forth - with the exception of attempts to change the user accounts in the containers of spare in the DA (add/remove application solutions, change quotas, etc.). First of all, I checked that it is not a LDAP problem - I use both ldapmodify command line and a GUI LDAPBrowser to edit the entries with no hiccups.
  
  I followed him that when you try to save the account information for the accounts in non-standard containers, the DA try always to use a path hardcoded (i.e. uid = username, ou = people, o = DOMAINNAME, dc = DOMAIN, dc = NAME) despite the fact that the user account is (and DA displays of) uid = USER name, or = morePeople, o = DOMAINNAME dc = DOMAIN, dc = NAME.
  
  Eventually, this "hard code" follows DA configuration in WEB-INF/classes/sun/comm/cli/server/servlet/serverconfig.properties that the list of parts of the LDAP structure:
  
  #############################################################################
  #
  # Ldap configuration.
  # List of hosts from ldap. Form is < ldaphost >: < PortNumber >. (By default the port = 389)
  # Add additional hosts with ldaphost - < number >
  # Schema type is '1' or '2 '.
  # Reconnect interval is in seconds
  # Group and people container is dn of dn (for example ou = people) Organization
  #
  #############################################################################
  ldaphost-1 = oucsldap01:389
  ldaphost-2 = oucsldap02:389
  ldaphost-suffix = dc = DOMAIN, dc = NAME
  ldaphost-dcsuffix = dc = DOMAIN, dc = NAME
  ldaphost-maxcount = 50
  ldaphost-schematype = 2
  ldaphost-reconnectinterval = 60
  peoplecontainer ldaphost = or = People
  groupcontainer ldaphost = or = Groups
  ldaphost-orgadminrole = cn = Admin role organization
  #####
  
  While the root of organization dn is not explicit here (and shouldn't be), the container of default people is... I could guess a logical programming error like this: indeed, the 'or = People' container should be used by default when you create a user through the DA; as likely a mistake, it could also be used when editing existing users - instead of their full DN/existing parent DN.
  
  Issues related to the:
  
  (1) anyone have a working configuration with several containers of user/group in an organization like this? Would you care to share details and solutions, if he had to?
  
  (2) I think that the 'field/organization shared hosting' mode might help here - at least it is planned to have several LDAP trees with their Managing Directors as a single e-mail domain. Before I go and reconfigure everything, I'd like to hear if there are stories of success with this route? It is a good solution (or solution) for this config?
  
  Thank you
  Jim Klimov

  I wanted to follow that reconfigure the directory structure according to domain hosting, with branches for SIE-synchronized accounts as one of the organizations which share the domain secondary and manually created accounts only OUCS being in another subsidiary organization. This method works for messaging components and the DA, as user ID are in OU = people in their organization. A little unfortunately, SIE config seems to allow only a single branch of target Department and set up groups (CN) here as well. Well, for our needs change the attributes of the user and application solutions via DA, that's enough. Sometimes, there are misfires (cannot save changes), but they are intermittent and more difficult to debug trace. usually disappear with the restart of the web container DA. Department LDAP instances are configured with plugins to apply the uniqueness of uid in the entire organization and the uniqueness of the values of the email messaging address attributes (mail, mailAlternateAddress, mailEqiuvalentAddress) in order to avoid setbacks between user accounts in different branches.

  Also, we had a problem with the calendar server after migrating LDAP entries: since our deployment used the nsUniqueID for identification of calendar user, relocation of entries (as we did) generated new values for new entries and users got new databases empty caledar. It wasn't a major problem on this POC and latest releases OUCS with a davUniqueID attribute must be specifically immune to this problem. However, for the other trodding this way I can suggest that they export the LDAP database in LDIF, including unique identifiers, re-create the suffixes if necessary (the Organization SIE in Department target should be a separate suffix of LDAP database), edit the LDIF entry path and import the LDIF anew. This would erase the old LDAP data and should add nsUniqueIDs old entries moved unlike (recreation via ldapadd) or relocation via a ldapmodrdn.

  We also hit a problem with DA refusing to return the list of accounts (that returns 0 or 25 empty entries in a table). LDAP logs showed that the Protocol LDAP side everything is ok, and expected responses amount was. Boss research often produced good food with a subset of users in da end, we linked the problem to binary EIS encoded base64 attributes (dspswuserlink and al.; some of these values as output garbaged commadmin queries in a terminal) and created an LDAP ACI, which forbade all our DA-admin user to read, to search compare these attributes. This solved the problem for us. I wonder if a more generic solution is possible, to apply this ACI not to a user explicitly named admin, but to all users with administrator privileges of DA (by group or role? what channel to cover them all in advance)? Or, perhaps, no one except the user account of EIS should see these attributes SIE?

  Hope this report helps others who are experimenting at the forefront of this road to integration of messaging

  Jim Klimov

• Report by user group links

  Hi, is it possible to define the 'report links' by user group
  
  for example, the report links are download, user group discount sales.
  
  report links are download, update and change to the admin user group sales.
  
  I just want to know if this is possible.
  
  Thank you!

  If "Sales" do not have the privilege of answers, then the "Modfiy" link will not be returned even if specified for the query. So you can just keep him and he will see all users who have access to the answers. Read only users (i.e. no responses) will not.

  See you soon,.
  C.

• MAC 5.1.5 server has additional sides to users/groups. (bug?)

  MAC OS El Capitan 10.11.5

  5.1.5 Server

  xserver MAC hardware

  I add user name and account in server 5.1.5. After a few users have added and little added group name. I check the list users and group and they seem good. in a few days later, I don't have a server change. I'm starting to capture more users. When I open the list of users, and I said ' WHAT *? Where * do they come from? "I like that ever before. I checked the list of groups. They have additional groups that I don't add them before as well.

  

  

  Seemingly, however, groups and hidden accounts becomes visible.

  My Question: Is it that I can hide back them as before?

  These additional users/groups entered integrated system. Do not remove them!

  They are normally hidden and you should be able to re - hide them by running Server.app then by going to the view menu and selecting "hide system accounts.

• MySQL users group

  I recently discovered that under system preferences > users & groups I had a new group called MySQL user group. Although none of my accounts have been checked / enabled in this group, I am concerned because I have not created this group. I recently installed XAMPP, which includes MariaDB but I remember ever install MySQL manually or the creation of this group of users. Is the group that is created by default in Mac OS X and I never noticed? Should I be worried?

  MariaDB is not a port of MySQL?  MariaDB created the group, I guess.

  R

• User group near Research Triangle Park

  National Instruments organizes a usergroup near RDU February 23!

  This is the first in a long series of presentations by Seneca5 hopefully.

  The presentation is targeted from beginner to the experienced. We'll be modeling a control system using a cRIO with FPGA and real-time.

  More information can be found at http://www.meetup.com/LabVIEW-User-Group/

  

  Feel free to ask any questions.

  That was fast...

  

• How to determine a user group

  Hello

  I have a tab control that has 6-7 tabs. I want to show some tabs to normal users and I want to hide some tabs from these users, only Admins can see them.  Is there a way to set the user access tab pages individually? In the tab control settings, there is only the security settings that apply to the tab control, not pages individually. I can show/hide the pages by program, but I need to know the name of groups (Administrator, operators, comments, everyone) to which the user is connected.

  According to the page it is also not possible

  Summary: How can I show/hide tabs depending on the user group?

  I use Labview 2014 SP1 32-bit on Win8.1 with the DSC module

  Ah ok

  In any case, I managed to get this info with the palette of DSC security screws: