SSM ON-Prem TACACS+ and Clearpass

[Counterdoc]

Hi,

I am trying to configure TACACS+ on our SSM On-Prem server so that I am able to login on the Webinterface with my AD user. The TACACS+ configuration is done in Clearpass. And the test in the configuration window on the SSM server was successful.

But as soon as I try to login with my user on the login window it is not working:

In Clearpass everything looks fine and I am not sure how I could debug that issue on the SSM side.

This is how my config in Clearpass looks:

Is anybody using Clearpass for TACACS+ and SSM? 

Thank you!

Cheers,
Marius

[ahollifield]

What are you trying to do?  Cisco SSM?  As Smart Software Manager?  Does SSM use TACACS+ priv levels?

[Counterdoc]

Yes, Cisco Smart Software Manager. At least it offers TACACS+ Auth in the settings:

[Counterdoc]

Just saw this message in the release notes:

So I guess I need to configure Clearpass to send back the correct user role. But I don't know which exact role I need to send and which service to use.

[ahollifield]

The three system role types are:  System User • System Operator • System Administrator.  Is this for CLI or GUI access to SSM?  It looks to me from the configuration guide that the GUI uses system roles while the CLI uses Privilege levels.  But it doesn't specify what those attributes should be.

As far as the Service, that's up to the ClearPass configuration and where you would like that service to live.  

[Counterdoc]

That's the problem I have. I don't know which attributes are needed for the GUI. I am still going through the logs on SSM side but there is not a lot of info in it. Like you said, the configuration guide doesn't specify anything unfortunately.

Apr 25 05:22:09 uzuh41 a17c57646a7b: (tacacs) Setup endpoint detected, running now.
Apr 25 05:22:09 uzuh41 a17c57646a7b: (tacacs) Request phase initiated.
Apr 25 05:22:10 uzuh41 a17c57646a7b: (tacacs) Authentication failure! unauthorized encountered.

[andrewswanson]

I use secure ldap for on-prem SSM access with no issues - the bug below states:

"It appears that there is no possibility of using TACACS attributes to fully automate User/Operator/Admin access."

hth

Andy

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvy62936