Manage Users

About User Profiles

A user profile defines a user's login, password, and role (permissions). You can configure both internal and external profiles for users. Internal user profiles reside in Cisco DNA Center and external user profiles reside on an external AAA server. A default user profile with SUPER-ADMIN-ROLE permissions is created when you install Cisco DNA Center.

About User Roles

Users are assigned user roles that specify the functions that they are permitted to perform:

• Administrator (SUPER-ADMIN-ROLE): Users with this role have full access to all of the Cisco DNA Center functions. They can create other user profiles with various roles, including those with the SUPER-ADMIN-ROLE.
• Network Administrator (NETWORK-ADMIN-ROLE): Users with this role have full access to all of the network-related Cisco DNA Center functions. However, they do not have access to system-related functions, such as backup and restore.
• Observer (OBSERVER-ROLE): Users with this role have view-only access to the Cisco DNA Center functions. Users with an observer role cannot access any functions that configure or control Cisco DNA Center or the devices it manages.

Create an Internal User

You can create a user and assign this user a role.

Before you begin

Only a user with SUPER-ADMIN-ROLE permissions can perform this procedure. For more information, see About User Roles.

Procedure

1. In the Cisco DNA Center GUI, click the Menu icon (≡) and choose System > Users & Roles > User Management.
2. Click Add.
3. Enter a first name, last name, email address, and username for the new user. The email address must meet the requirements for the standard Apache EmailValidator class.
4. Under Role List, choose one of the following roles: SUPER-ADMIN-ROLE, NETWORK-ADMIN-ROLE, or OBSERVER-ROLE.
5. Enter a password and confirm it. The password must contain:
   • At least eight characters
   • A character from at least three of the following categories:
     • Lowercase letter
     • Uppercase letter
     • Number
     • Special character
6. Click Save.

Edit a User

You can edit some user properties (but not the username).

Before you begin

Only a user with SUPER-ADMIN-ROLE permissions can perform this procedure. For more information, see About User Roles.

Procedure

1. In the Cisco DNA Center GUI, click the Menu icon (≡) and choose System > Users & Roles > User Management.
2. Click the radio button next to the user that you want to edit.
3. Click Edit.
4. Edit the first or last name or email address, if needed.
5. Under Role List, choose a new role, if needed: SUPER-ADMIN-ROLE, NETWORK-ADMIN-ROLE, or OBSERVER-ROLE.
6. Click Save.

Delete a User

Before you begin

Only a user with SUPER-ADMIN-ROLE permissions can perform this procedure. For more information, see About User Roles.

Procedure

1. In the Cisco DNA Center GUI, click the Menu icon (≡) and choose System > Users & Roles > User Management.
2. Click the radio button next to the user that you want to delete.
3. Click Delete.
4. At the confirmation prompt, click Continue.

Reset a User Password

You can reset another user's password. For security reasons, passwords are not displayed to any user, not even those with administrator privileges.

Before you begin

Only a user with SUPER-ADMIN-ROLE permissions can perform this procedure. For more information, see About User Roles.

Procedure

1. In the Cisco DNA Center GUI, click the Menu icon (≡) and choose System > Users & Roles > User Management.
2. Click the radio button next to the user whose password you want to reset.
3. Click Reset Password.
4. Enter a new password and confirm it. The new password must contain:
   • At least eight characters
   • A character from at least three of the following categories:
     • Lowercase letter
     • Uppercase letter
     • Number
     • Special character

Change Your Own User Password

Before you begin

Only a user with SUPER-ADMIN-ROLE permissions can perform this procedure. For more information, see About User Roles.

Procedure

1. In the Cisco DNA Center GUI, click the Menu icon (≡) and choose System > Users & Roles > Change Password.
2. Enter information in the required fields.
3. Click Update.

Change Your Own User Password without Admin Permission

The following procedure describes how to change your password without admin permission.

1. In the Cisco DNA Center GUI, click the Menu icon (≡), hover your cursor over admin and choose My Profile and Settings > My Account.
2. Click Update Password.
3. In the Update Password dialog box, enter the current password, new password and confirm new password.
4. Click Update.

Reset a Forgotten Password

If you forgot your password, you can reset it through the CLI.

1. Enter the following command to check if the user is created in the system.
   magctl user display <username>
   The command returns the tenant-name, which can be used to reset the password. The output looks similar to the following:
2. User admin present in tenant TNT0 (where TNT0 is the tenant-name)
3. Enter the tenant-name in the following command to reset the password.
   magctl user password update <username> <tenant-name>
4. You are prompted to enter a new password.
5. Enter a new password.
6. You are prompted to re-enter the new password to confirm.
7. Enter the new password. The password is reset and you can log in to Cisco DNA Center using the new password.

Configure Role-Based Access Control

Cisco DNA Center supports role-based access control (RBAC), which enables a user with SUPER-ADMIN-ROLE privileges to define custom roles that permit or restrict user access to certain Cisco DNA Center functions. Use this procedure to define a custom role and then assign a user to that role.

Before you begin

Only a user with SUPER-ADMIN-ROLE permissions can perform this procedure.

Procedure: Define a custom role

1. In the Cisco DNA Center GUI, click the Menu icon (≡) and choose System > Users & Roles > Role Based Access Control.
2. Click Create a New Role. The Create a Role window appears. If this is your first iteration of RBAC, after you have created the new role, you will be asked to assign users to the new role.
3. Click Let's Do it. If you want to skip this screen in the future, check the Don't show this to me again check box.
4. The Create a New Role window appears. Enter a name for the role and then click Next.
5. The Define the Access window appears with a list of options. By default, the observer role is set for all Cisco DNA Center functions.
6. Click the > icon corresponding to the desired function to view the associated features.
7. Set the permission level to Deny, Read, or Write for the desired features. If you set the permission level of a feature to Deny, the user to whom you assign this role cannot view this feature in the GUI.
8. Click Next. The Summary window appears.
9. Review the summary. If the information is correct, click Create Role. Otherwise, click Edit and make the appropriate changes. The Done, Role-Name window appears.

Procedure: Assign a user to a custom role

1. To assign a user to the custom role you just created, click Add Users. The User Management > Internal Users window appears, which allows you to assign the custom role to an existing user or to a new user.
2. To assign the custom role to an existing user:
   1. In the Internal Users window, click the radio button next to the user to whom you want to assign the custom role, and then click Edit. The Update Internal User slide-in pane appears.
   2. From the Role List drop-down list, choose the custom role, and then click Save.
3. To assign the custom role to a new user:
   1. Click Add. The Create Internal User slide-in pane appears.
   2. Enter the first name, last name, and username in the fields provided.
   3. From the Role List drop-down list, choose the custom role to assign to the new user.
   4. Enter the password and then confirm it.
   5. Click Save.
4. If you are an existing user who was logged in when the administrator was making changes to your access permissions, you must log out of Cisco DNA Center and then log back in for the new permission settings to take effect.

Cisco DNA Center User Role Permissions

Table 1: Cisco DNA Center User Role Permissions

Display Role-Based Access Control Statistics

You can display statistics that show how many users belong to each user role. You can also drill down to view the list of users who have a selected role.

1. In the Cisco DNA Center GUI, click the Menu icon (≡) and choose System > Users & Roles > Role Based Access Control. All default user roles and custom roles are displayed.
2. Click the number corresponding to each user role to view the list of users who have that role.

Configure External Authentication

If you are using an external server for authentication and authorization of external users, you should enable external authentication in Cisco DNA Center.

Before you begin

Only a user with SUPER-ADMIN-ROLE permissions can perform this procedure. For more information, see About User Roles.

You must configure at least one authentication server.

Note

The external authentication fallback behavior has changed in this Cisco DNA Center release. In releases earlier than 2.1.x, when external authentication is enabled, Cisco DNA Center falls back to local users if the AAA server is unreachable or the AAA server rejects an unknown username. In the current release, Cisco DNA Center does not fall back to local users if the AAA server is unreachable or the AAA server rejects an unknown username.

To enable external authentication fallback, SSH to the Cisco DNA Center instance and enter the following CLI command:
magctl rbac external_auth_fallback enable

Procedure

1. In the Cisco DNA Center GUI, click the Menu icon (≡) and choose System > Users & Roles > External Authentication.
2. To enable external authentication in Cisco DNA Center, check the Enable External User check box.
3. (Optional) Configure the AAA attribute.
4. For TACACS authentication, the following AAA attributes are supported:

5. For RADIUS authentication, the following AAA attributes are supported:

6. In the AAA Attribute field, enter the appropriate attribute for your use case, as described in the preceding tables.
7. Click Update.
8. (Optional) Configure the AAA server or servers. Configure these settings only if you want to swap the current primary or secondary AAA servers or define different AAA servers. In the Cisco DNA Center GUI, click the Menu icon (≡) and choose System > Settings > External Services > Authentication and Policy Servers to open the Authentication and Policy Servers window.
9. From the Primary AAA Server IP Address drop-down list, choose the IP address of one of the preconfigured AAA servers.
10. From the Secondary AAA Server IP Address drop-down list, choose the IP address of one of the preconfigured AAA servers.
11. (Optional) If you are using a Cisco ISE server, you can update the settings, if necessary. For information about Cisco ISE policies, see "Configure and Manage Policies" in the Cisco Identity Services Engine Administrator Guide.

Table 2: Cisco ISE Server Settings

13. (Optional) To update advanced settings, click View Advanced Settings and update the settings, if necessary.

Table 3: AAA Server Advanced Settings

14. Click Update.

Two-Factor Authentication

Two-factor authentication, also known as 2FA, adds another layer of security to user verification by using an identifier method in addition to a user's name and password. The identifier method is generally something that only the actual intended user possesses (such as a phone app or keyfob) and is intentionally separated from the original login method.

The Cisco DNA Center implementation of two-factor authentication supports the use of a token client (that generates single-use token codes after the appropriate PIN is entered), a token server (that validates token codes), and an authentication server to manage user access. Authentication can be handled using either the RADIUS or TACACS+ protocol.

The topics in this section describe:

• The requirements that need to be in place in order to implement two-factor authentication.
• The necessary configuration settings you need to make.
• The Cisco DNA Center login procedure using two-factor authentication.

Prerequisites for Two-Factor Authentication

The following prerequisites must be in place in order to set up two-factor authentication for use with Cisco DNA Center:

• An authentication server that is able to return attribute-value pairs to convey RBAC role authorizations for authenticated Cisco DNA Center users. In our example, we use Cisco Identity Services Engine (Cisco ISE) 2.3 Patch 1.
• A two-factor token server that you will integrate with your authentication server. In our example, we use RSA Authentication Manager 7.2.
• A token card application on the client's machine that generates software tokens. In our example, we use RSA SecurID Software Token.

Two-Factor Authentication Workflow

Here is a summary of what happens when a user logs in to a Cisco DNA Center appliance on which two-factor authentication has been configured:

1. In an RSA SecurID token client, a user enters their PIN to get a token code.
2. In the Cisco DNA Center login page, they enter their username and token code.
3. Cisco DNA Center sends the login request to Cisco ISE using either the RADIUS or TACACS+ protocol.
4. Cisco ISE sends the request to the RSA Authentication Manager server.
5. RSA Authentication Manager validates the token code and informs Cisco ISE that the user has been authenticated successfully.
6. Cisco ISE matches the authenticated user with their configured authorization profile and returns the role=NETWORK-ADMIN-ROLE attribute-value pair.
7. Cisco DNA Center grants access to the features and pages associated with the user's role-based access control (RBAC) role.

Configure Two-Factor Authentication

To configure two-factor authentication on your Cisco DNA Center appliance, complete the following procedure.

Step 1: Integrate RSA Authentication Manager with Cisco ISE

1. In RSA Authentication Manager, create two users: cdnac_admin (for the Admin user role) and cdnac_observer (for the Observer role). For more information, see the "Add a User to the Internal Database" topic in the RSA Self-Service Console Help. To access this topic, do the following:
   1. Open the RSA Self-Service Console Help.
   2. In the Search help field, enter Add a User to the Internal Database and then click Search help.
2. Create a new authentication agent. For more information, see the "Add an Authentication Agent" topic in the RSA Self-Service Console Help.
3. Generate the Authentication Manager agent configuration file (sdconf.rec):
   1. From the RSA Security Console, choose Access > Authentication Agents > Generate Configuration File. The Configure Agent Timeout and Retries tab opens.
   2. For the Maximum Retries and Maximum Time Between Each Retry fields, use the default values.
   3. Click Generate Configuration File. The Download Configuration File tab opens.
   4. Click the Download Now link.
   5. When prompted, click Save to Disk to save a local copy of the zip file.
   6. Unzip the file and use this version of the sdconf.rec file to overwrite the version that is currently installed on the agent.
4. Generate a PIN for the cdnac_admin and cdnac_observer users you created in Step 1a. For more information, see the "Create My On-Demand Authentication PIN" topic in the RSA Self-Service Console Help.
5. Start Cisco ISE, choose Administration > Identity Management > External Identity Sources > RSA SecurID, and then click Add.
6. In the RSA SecurID Identity Sources page, click Browse, choose the sdconf.rec file you downloaded, and then click Open.
7. Check the Reauthenticate on Change PIN check box, then click Submit.

Step 2: Create Authorization Profiles

Create two authorization profiles, one for the Admin user role and one for the Observer user role.

1. In Cisco ISE, choose Policy > Policy Elements > Results > Authorization > Authorization Profiles.
2. For both profiles, enter the following information:
   • Name field: Enter the profile's name.
   • Access Type field: Choose ACCESS_ACCEPT.
   • Advanced Attributes Settings area: Choose Cisco:cisco-av-pair from the first drop-down list. If you are creating an authorization profile for the Admin user role, choose Role=NETWORK-ADMIN-ROLE from the second drop-down list. If you are creating an authorization profile for the Observer user role, choose Role=OBSERVER-ROLE from the second drop-down list.

Step 3: Create Authentication Policy

Create an authentication policy for your Cisco DNA Center appliance. In the Cisco Identity Services Engine Administrator Guide, see the "Configure Authentication Policies" topic.

Step 4: Create Authorization Policies

Create two authorization policies, one for the Admin user role and one for the Observer user role. In the Cisco Identity Services Engine Administrator Guide, see the "Configure Authorization Policies" topic.

Step 5: Verify Token Assignment

In the RSA Authentication Manager Security Console, verify that software tokens have been assigned to both users. For more information, see the "View a Token" topic in the RSA Self-Service Console Help. Note If you need to assign tokens, complete the steps described in the "Assign a Software Token to a User" topic.

Enable Two-Factor Authentication Using RADIUS

To enable two-factor authentication that uses a Cisco ISE server configured for RADIUS, complete the following procedure:

1. Integrate Cisco ISE with Cisco DNA Center. In the Cisco DNA Center Installation Guide, see the "Integrate Cisco ISE with Cisco DNA Center" topic.
2. Configure Cisco DNA Center to use your Cisco ISE server for authentication. See Configure External Authentication. Important Ensure that you specify the same shared secret for both Cisco ISE and Cisco DNA Center.

Enable Two-Factor Authentication Using TACACS+

To enable two-factor authentication that uses a Cisco ISE server configured for TACACS+, complete the following procedure:

1. In Cisco ISE, choose Administration > Network Resources > Network Devices to open the Network Devices window.
2. Click TACACS Authentication Settings to view its contents and ensure that a shared secret has already been configured for the Cisco DNA Center device you added previously.
3. Choose Work Centers > Device Administration > Policy Elements to open the TACACS Profiles window.
4. Create TACACS+ profiles for the cdnac_admin and cdnac_observer user roles:
   1. Click Add.
   2. Complete the following tasks:
      • Enter the profile's name.
      • After clicking the Raw View tab, enter the following text into the Profile Attributes text box:
        • For the cdnac_admin user role, enter Cisco-AVPair=ROLE=NETWORK-ADMIN-ROLE
        • For the cdnac_observer user role, enter Cisco-AVPair=ROLE=OBSERVER-ROLE
   3. Click Save.
5. Integrate Cisco ISE with Cisco DNA Center. In the Cisco DNA Center Installation Guide, see the "Integrate Cisco ISE with Cisco DNA Center" topic.
6. Configure Cisco DNA Center to use your Cisco ISE server for authentication. See Configure External Authentication. Important Ensure that you specify the same shared secret for both Cisco ISE and Cisco DNA Center.

Log In Using Two-Factor Authentication

To log in to Cisco DNA Center using two-factor authentication, complete the following procedure:

1. From the Cisco DNA Center login page, enter the appropriate username.
2. Open the RSA SecurID token client and enter the PIN you configured previously to generate a one-time token.
3. Copy this token and paste it in to the Cisco DNA Center login page's Password field.
4. Click Log In.

Display External Users

You can view the list of external users who have logged in through RADIUS/TACACS for the first time. The information that is displayed includes their usernames and roles.

1. In the Cisco DNA Center GUI, click the Menu icon (≡) and choose System > Users & Roles > External Authentication.
2. Scroll to the bottom of the window, where the External Users area lists the external users.