Cisco DCNM Fundamentals Guide, Release 11.x - Cisco DCNM User Roles [Cisco Data Center Network Manager 11] (2024)

Cisco DCNM user-based access allows the administrator to control the access to the Cisco DCNM server by using the DCNM client (Web Client or LAN client). The user access is secured by a password.

Note	Beginning from Release 10.0(x), DCNM doesn’t allow you to reset the password using adduser script. Log on to Cisco DCNM Web UI to reset the password. Use the adduser script to add a new DCNM user on the existing DCNM setup.

Cisco DCNM performs authorization of access to the users based on roles. The role-based authorization limits access to the Cisco DCNM server operations based on the roles to which the users are assigned. Cisco DCNM doesn’t define new roles to access the DCNM server; however, the Cisco DCNM leverages the existing roles that are supported on the devices monitored, such as Cisco MDS 9000 Series Switches, and Cisco Nexus Switches.

The table below lists the roles supported by Cisco DCNM:

In a typical enterprise environment, users and their roles are defined in a centralized place such as, TACACS+, RADIUS, or LDAP. As Cisco DCNM supports the existing device roles, the administrator need not define new roles specifically.

Cisco DCNM supports the assignment of a user role by the RADIUS or TACACS+ server that grants a user access to the Cisco DCNM client. The user role assigned to a user is in effect for the current session in the Cisco DCNM client only.

To assign a Cisco DCNM user role by RADIUS, configure the RADIUS server to return the RADIUS vendor-specific attribute 26/9/1, which is the Cisco-AV-Pair attribute. To assign a Cisco DCNM user role by TACACS+, the TACACS+ server must return a cisco-av-pair attribute-value pair. If an authentication response doesn’t assign the user role, Cisco DCNM assigns the User role. Table 1 shows the supported attribute-value pair values for each Cisco DCNM user role.

shell:roles = "network-operator"

shell:roles = "network-admin"

DCNM-Scope Mapping

Cisco DCNM allows you to add fabric names in TACACS using cisco-av-pairs. You can enable different AV pairs for any supported attribute value.

See Also

Cisco Nexus Dashboard Fabric Controller: A New Era in Data Center Network AutomationTop Ten Benefits of Upgrading from DCNM to NDFC SANCisco Nexus Dashboard Fabric Controller (Formerly DCNM) - Cisco Data Center Network Manager 11 Data SheetCisco Data Center Network Manager 11

Cisco-av-pair=shell:roles="network-admin": dcnm-access="n9k-macsec fcoe-N9k"

Cisco-av-pair=shell:roles="network-admin": dcnm-access="fabric_M9706 Fabric_v-92"

These av-pairs appear on the Cisco DCNM Web UI > Scope drop-down list, based on the user access.

Cisco DCNM perspective defines the operations that you can perform on the Cisco DCNM client by controlling the menu and tool bar items. Different perspectives define different set of operations.

For example, the Admin perspective allows all the operations by showing all the menu and tool bar items whereas Operator perspective allows limited set of operation by hiding Admin and Config Menu items.

Each DCNM user role is mapped to a particular DCNM perspective, which allows limited access to server features. DCNM clients support following four perspectives:

Table 1 describes how DCNM roles are mapped to client perspectives.

From Release 11.3(1), Cisco DCNM offers the user access based on your network security requirements. The following user roles allow access to DCNM via SSH or console that is introduced with Release 11.3(1).

• sysadmin user

  This DCNM OS user role is considered as the system administrator.

  sysadmin user role allows you to run appmgr and other system commands for managing and debugging the system such as reboot, tcpdump, etc. However, the user can function as a root user by using the su command.

  Note	The root user role is required to read log files.

• SSH access by user root

  On a Native HA setup using DCNM Management IPv4 VIP, SSH access with root user is allowed from DCNM to DCNM Computes. SSH access with root user is always allowed between HA peers. When adding a second node to a Standalone system or to a Native-HA setup (while restoring the secondary node), SSH access must be permitted for the installation to complete successfully.

  By default, SSH access with root user is disabled. Alternatively, you can use the sysadmin user.

  You can change the SSH access with root user by using the following command:

  appmgr root-access {permit|deny|without-password}

Note	The DCNM GUI root user is no longer created. Alternatively, use the Admin user role to log on to the DCNM Web UI.