tac_plus and Cisco Wireless Controller

[Daniel Moraes]

Hi folks,

We are configuring a WLC to authenticate against tac_plus. If I set 'set role1 = ALL' everything works fine.

        group = USERS {
                message = "[Admin privileges]"
                default service = permit
                service = shell {
                        default command = permit
                        default attribute = permit
                        set priv-lvl = 15
                }
                service = ciscowlc {
                        #role1 = ALL
                        ### Allowed Roles: ALL, MONITOR, WLAN, CONTROLLER, WIRELESS, SECURITY, MANAGEMENT and COMMAND
                        protocol = common {
                                set role1 = ALL
                        }
                }
        }


But when I wanna restrict the access using the configuration bellow:

        group = guest {
                default service = permit
                enable = deny
                service = shell {
                        default command = permit
                        default attribute = permit
                        set priv-lvl = 1
                }
                service = ciscowlc {
                        protocol = common {
                                set role1=MONITOR
                        }
                }
        }

        user = readonly {
                password = clear readonly
                member = guest
        }


Or been, setting the role1 with 'MONITOR' is the same I set to 'ALL' and I can see all menus into Cisco Wireless Controller (including make changes). Please could you help me?

Thank you!

Daniel

[Aleksey Mochalin]

Hello Daniel,

Could you try to use service like that:

service = ciscowlc {
  set role1=MONITOR
  }

}

Best Regards, Aleksey

[Daniel Moraes]

Hi Aleksey,

Thanks for your answer but I did the suggested adjustment and didn't work properly and I can see all menus.

[Daniel Moraes]

Hi folks,

I'm able to receive more suggestions about the theme.

Thanks!

Daniel

[Aleksey Mochalin]

Hello Daniel,

Could you give the output of debug command --> debug aaa tacacs enable

I found it here.

Aleksey

[Daniel Moraes]

Hi Aleksey,

I've attached the output.

Thank you.

Daniel

[Aleksey Mochalin]

Seems like something wrong with device. It gets correct attribute but works incorrectly. means that user get monitor rights

arg[0] = [13][role1=MONITOR]
*tplusTransportThread: Oct 25 10:26:08.147: User has the following mgmtRole 4

User has the following mgmtRole 4 <-- means that user get monitor rights

LOBBY = mgmtRole 2 
WLAN = mgmtRole 8
CONTROLLER = mgmtRole 10
WIRELESS = mgmtRole 20
SECURITY = mgmtRole 40
MANAGEMENT = mgmtRole 80
COMMANDS = mgmtRole 100

mgmtRole also can be combined, e.g.  role1=CONTROLLER role2=WIRELESS equal to mgmtRole 30

Hope it helps.

Best Regards, Aleksey

[Daniel Moraes]

Thank you for your quick answer :-).

So I'll put the device under investigation and some news I'll tell you.