Cisco WLC and tac_plus configuration

[Askon]

Hello,

I'm trying to configure cisco WLC 5508 to use tacacs.
I use this guide to configure TACACS on WLC -
http://www.cisco.com/en/US/docs/wireless/controller/7.0MR1/configuration/guide/cg_security_sol.html#wp1697872
On WLC side I have successfully configured AAA, I see accounting in
tac_plus logs, access logs show successful authorization, but I can't
login to WLC.
Debug on WLC show me:
*tplusTransportThread: Jan 13 15:57:13.478: author response body:
status=1 arg_cnt=0 msg_len=0 data_len=0

*tplusTransportThread: Jan 13 15:57:13.478:
User has the following
mgmtRole 0

I have configured tac_plus for WLC in this way, according to
configuration example for ACS server
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_tech_note09186a0080851f7c.shtml#topic3:

group=wlc-admins {
default service = permit
service = ciscowlc {
set role1 = ALL
}
}

user=user1 {
debug = CMD
default service = permit
login = clear 123
service = shell {
default cmd = permit
set priv-lvl = 15
}
client = wlc-cisco
member = wlc-a...@192.168.1.1
}


As far as I understand TACACS server should be able send to WLC:
1. ciscowlc for Service
2. Custom attributes role1, role2 etc. For example role1=ALL

Any suggestion?

[Charl Matthee]

Hi,

The following config works for our access to WLCs:

group = admin {

default service = permit
service = ciscowlc {

default protocol = permit
set role1 = ALL
}
enable = login
}

[Benjamin Allen]

so, this fix shows the proper group config,

what about the user config?

[daniel...@intersection.com]

Did anyone get this working? I am getting successful authentication but the wlc keeps prompting me to login again. I am also seeing the mgmtRole 0 message in the wlc debugs. I also tried this example http://www.tacacs.org/tacacsplus/2008/11/04/cisco-wireless-control-system#comments-54ad5834e4b0f2d6f427623f= but same issue.

Any help is appreciated.

Danny

[Shin Sterneck]

Hi Danny,

yes, this works well for me both on H/W and S/W WLCs

here a working configuration:

group = WlcAdmins {

 default service = permit

 enable = login

 # Service Name: ciscowlc 

 # Service Description: Cisco WLC Service 

 service = ciscowlc {

  set role1 = ALL

 }

}

Then just add/drop the user into this group and you should be set to go.

Regards,

Shin