Description

TACACS+ Authorization Problems with ACS 5.2 while integrating EX Switches and SRX Devices

Symptoms

While integrating EX Switches, with CISCO ACS 5.2 TACACS+ server, some authorization issues and messages were observed. The authorization was not working at all (permissions, allow/deny, commands/configurations):

- Invalid token in command authorization for user ' <username> '

This message was observed in the EX log messages whenever a user was logging in.

    -  Invalid permissions from authorization server: <permission-name>

    This message was also observed in the EX log messages when a user was logging in.


    - Error: unable to authenticate: bad auth parameter

    This message was observed in the console display just after the user was logging in.

Solution


The solution is that in the ACS the permissions and allow/deny , commands/configurations, were configured between double quotes ("") . After removing the quotes the error messages stopped.

An additional note is that the permissions configured on the ACS are additive to the local class permissions configured for the user remote.

Initially the user remote was in the super-user class with all permissions. To make the permissions configured on the ACS server effective the user remote should be configured to a new class with minimum permissions like view (class TEST with view permission, for example). Then the permissions coming from the ACS server will be added to the local ones.


To check the authorization for a user inside the EX switch the command below can be used:

jtac@EX4200-01> show cli authorization

Current user: 'remote' login: 'jtac' class 'TEST'
Permissions:
configure -- Can enter configuration mode
network -- Can access the network
view -- Can view current values and statistics
Individual command authorization:
Allow regular expression: none
Deny regular expression: none
Allow configuration regular expression: (^vlans .* interface .*)
Deny configuration regular expression: (.*)


To check the meaning of structured syslog messages the commands below can be used:

root> help syslog UI_CMD_AUTH_TOKEN_INVALID
Name: UI_CMD_AUTH_TOKEN_INVALID
Message: Invalid token in command authorization for user ' <username> '
(file <filename> ): <error-message>
Help: This user's command authorization file contains syntax errors
Description: The management daemon could not parse the command authorization
file for this user.
Type: Internal: Internal log message
Severity: notice
Facility: ANY
Cause: An internal software failure occurred.
Action: Contact your technical support representative.


root> help syslog UI_INVALID_REMOTE_PERMISSION
Name: UI_INVALID_REMOTE_PERMISSION
Message: invalid permissions from authorization server: <permission-name>
Help: Authorization server specified invalid permission
Description: RADIUS and TACACS+ authorization servers use Juniper Networks
vendor-specific attributes (VSAs) to specify user permissions. A
VSA included the indicated permission name, which is invalid.
Type: Error: An error occurred
Severity: error
Facility: ANY