• LDAP

• Active Directory

• TACACS+

• RADIUS

The Juniper Apstra server and Open Source provider configuration examples for OpenLDAP, tac_plus, and FreeRADIUS are available at Providers . 

Setting Up Authentication and Authorization Log Level to DEBUG

For troubleshooting authentication and authorization on the Juniper Apstra server, a DEBUG level AuthAgent log can be used as follows:

1. On the Juniper Apstra AOS server, add the following line in the /etc/aos/aos.conf file.

admin@aos-server:~$ sudo vi /etc/aos/aos.conf

[authentication]
log_config=DEBUG  <== add this line

2. Restart AOS.

admin@aos-server:~$ sudo service aos restart

3. Run the following command, and then try to access the AOS server UI.

admin@aos-server:~$ sudo tail -f /var/log/aos/auth/AuthAgent.err

4. After log collection, remove log_config=DEBUG from aos.conf , and then restart AOS again.

Sample DEBUG level log output

Access the UI as user ldapadmin2 with password ldapadmin2 .

admin@aos-server:/var/log/aos$ sudo tail -f /var/log/aos/auth/AuthAgent.err 
..snip..
2021-08-23 23:33:34,887 37:DEBUG:RBAC:username admin found in token, expire_at: 1629845760
2021-08-23 23:33:34,888 37:INFO:RBAC:LOGGED OUT: user admin is logged out.
2021-08-23 23:33:35,046 37:DEBUG:RBAC:InvalidTokenError: Not enough segments
2021-08-23 23:33:35,047 37:DEBUG:RBAC:Resource type: Versions, Action: read, Resource Instance: *
2021-08-23 23:33:35,047 37:DEBUG:RBAC:ALLOWED - NO AUTHENTICATION REQUIRED
2021-08-23 23:33:44,870 37:DEBUG:RBAC:LDAP encryption None, urls: ['ldap://172.20.97.4:389']
2021-08-23 23:33:44,871 37:DEBUG:RBAC:LDAP encryption None, urls: ['ldap://172.20.97.4:389']
2021-08-23 23:33:44,871 37:DEBUG:RBAC:Searching LDAP server 172.20.97.4, search_dn ou=users,dc=apstra,dc=com, search_filter (&(objectClass=inetOrgPerson)(uid=ldapadmin2)), attrs ['uid'], target user
2021-08-23 23:33:44,872 37:DEBUG:RBAC:Init LDAP client, encryption: None, urls: ldap://172.20.97.4:389
2021-08-23 23:33:44,874 37:INFO:RBAC:LDAP - Trying to login user dn: cn=ldapadmin2,ou=users,dc=apstra,dc=com
2021-08-23 23:33:44,875 37:DEBUG:RBAC:Init LDAP client, encryption: None, urls: ldap://172.20.97.4:389
2021-08-23 23:33:44,876 37:DEBUG:RBAC:User ldapadmin2 binded successfully.
2021-08-23 23:33:44,877 37:DEBUG:RBAC:LDAP encryption None, urls: ['ldap://172.20.97.4:389']
2021-08-23 23:33:44,878 37:DEBUG:RBAC:Searching LDAP server 172.20.97.4, search_dn ou=users,dc=apstra,dc=com, search_filter (|(mail=ldapadmin2)(email=ldapadmin2)(mail=ldapadmin2)(uid=ldapadmin2)(uid=ldapadmin2)), attrs ['*'], target user
2021-08-23 23:33:44,878 37:DEBUG:RBAC:Init LDAP client, encryption: None, urls: ldap://172.20.97.4:389
2021-08-23 23:33:44,879 37:DEBUG:RBAC:LDAP query user ldapadmin2 result : [('cn=ldapadmin2,ou=users,dc=apstra,dc=com', {'cn': ['ldapadmin2'], 'objectClass': ['inetOrgPerson', 'posixAccount', 'top'], 'loginShell': ['/bin/sh'], 'userPassword': ['ldapadmin2'], 'uidNumber': ['1009'], 'gidNumber': ['500'], 'sn': ['ldapadmin2'], 'homeDirectory': ['/home/users/ldapadmin2'], 'mail': ['[email protected]'], 'givenName': ['ldapadmin2'], 'uid': ['ldapadmin2']})]
2021-08-23 23:33:44,880 37:DEBUG:RBAC:LDAP info for ldapadmin2: {'cn': ['ldapadmin2'], 'objectClass': ['inetOrgPerson', 'posixAccount', 'top'], 'loginShell': ['/bin/sh'], 'userPassword': ['ldapadmin2'], 'uidNumber': ['1009'], 'gidNumber': ['500'], 'sn': ['ldapadmin2'], 'homeDirectory': ['/home/users/ldapadmin2'], 'mail': ['[email protected]'], 'givenName': ['ldapadmin2'], 'uid': ['ldapadmin2']}
2021-08-23 23:33:44,880 37:DEBUG:RBAC:LDAP encryption None, urls: ['ldap://172.20.97.4:389']
2021-08-23 23:33:44,880 37:DEBUG:RBAC:Info of remote LDAP user ldapadmin2: ldapadmin2, ldapadmin2, [email protected]
..snip..