Example: configuring authentication

This procedure describes how to use CLI commands to configure authentication for an appliance.

Prerequisites

To configure the authentication:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Authenticate first from the local user/password settings, then from RADIUS if that does not work, then from LDAP if RADIUS does not work, and finally from TACACS+ if LDAP does not work:
```
hostname (config) # aaa authentication login default local radius ldap tacacs+
```
For users who do not exist in the local user/password settings, if there is no Local-User attribute returned by the RADIUS, LDAP, or TACACS+ server at login time, the login will have the same capabilities as the Monitor user. Otherwise, it will have the capabilities of the username given by the attribute.
```
hostname (config) # aaa authorization map default-user monitor
hostname (config) # aaa authorization map order remote-first
```

Configure the IP address and secret of the RADIUS server:

hostname (config) # radius-server host 10.1.0.58 key myradius123

Configure the IP address and secret of the TACACS+ server:

hostname (config) # tacacs-server host 10.1.0.58 key mytac123

Configure the fully-qualified hostname of the LDAP server. The hostname (not the IP address) is needed for the optional TLS certificate validation to work.
```
hostname (config) # ldap host orange.purple.com
```
Configure the IP address of the LDAP server, as a fallback mechanism:
```
hostname (config) # ldap host 10.1.0.58
```

Configure the base of the user tree for LDAP:

hostname (config) # ldap base-dn ou=users,dc=orange,dc=com

Configure the LDAP user schema name for LDAP:

hostname (config) # ldap login-attribute uid

Configure the base of the group tree for LDAP:

hostname (config) # ldap group-dn cn=authgroup1,ou=groups,dc=orange,dc=com

Configure the LDAP group schema name for membership:
```
hostname (config) # ldap group-attribute member
```
Save your changes:
```
hostname (config) # write memory
```