Remote user authentication

Cloud connection

When a remote user connects to the RADKit Service through the cloud, then the authentication of the remote user is performed by the cloud, and my even include MFA (all Cisco personnel, select partners and customers).

Direct connection

When a remote user connects directly to the RADKit Service, without using the cloud, then the authentication of the remote user is performed by the RADKit Service itself. The credentials of the remote user can either * stored in the RADKit database, managed by the RADKit Service administrator (we call them validation tokens) * delegated to an external system, such as a TACACS+ server

E2EE validation token

The validation token is set by the administrator (or it can be randomized in the WebUI) and is used as a password authentication, s

../_images/remote_user_authentication_validation_token.png

Copy the validation token, and provide it to the remote user for login. As it would be unsafe for the remote user to entrust their credentials to a RADKit Service they do not own, this is to be considered a validation token, known by the remote user and RADKit administrator, and not a user-only secret.

TACACS+ authentication

RADKit can be configured to authenticate remote users against a TACACS+ server. In this case, the credentials of the remote user are stored in the TACACS+ server and are managed by the TACACS+ server administrator.

When a remote user connects to the RADKit Service, the RADKit Service will authenticate the user against the TACACS+ server. The TACACS+ server will return a response indicating whether the authentication was successful or not, and may also include additional information such as the allowed connection modes for the user.

In order to activate TACACS+ authentication for a remote user, set up the desired TACACS+ server from the drop down, then configure the TACACS+ user account to map the remote user to:

../_images/remote_user_authentication_tacacs.png

In the example above, the chosen TACACS+ server is named enterprise” and the remote user Jane Doe will be mapped to the account “as-engineers”.

To set up such a TACACS+ server, see TACACS+.

End-to-end user authentication

When a remote user connects to the RADKit Service through the cloud, an additional layer of authentication can be performed locally by the RADKit Service.

All the authentication methods made available by the RADKit Service for direct connections can be used for this second layer of authentication, including external sources of type Remote User.

This allows for example to require that cloud-connected users authenticate with a second factor through an external source, such as a TACACS+ server or a local token, providing a layer of independent end-to-end authentication from the cloud.

To activate end-to-end user authentication, the setting service.e2ee.require_e2ee_session_verification must be enabled globally.

../_images/remote_user_e2ee_validation.png

See Service settings for more information on this setting and how to enable it through CLI parameters, environment variables, or TOML settings (for more information, see Settings management).