How to configure management authentication on IAP using Tacacs Server?

Question

Requirement:
Instant access points come with default username and password i.e  admin/admin.  This does not go long way, as the IAP start finding their place in campus and corporate networks.
With many administrators managing and monitoring the clustered IAP networks, TACACS or Active Directory based authentication is more useful.
Solution:
Keep this in view, IAP development teams have integrated TACACS and Radius based management authentication. 
Configuration:
Follow the below steps to configure radius authentication in IAP:
Login to IAP web interface
Select "System" from the main menu and then click on "Admin" tab
Under local authentication, select as "Authentication Server"
Under the "Auth Server 1" Select "New Server"
Filling the name, IP address and shared key for Tacacs server and click OK.
Verification
Logout of the IAP web interface and try logging in using the username and password on TACACS server.

Answer 1

I was having troubles with this as well when a customer had an older Aruba Controller and 2 Access Points. We went with a couple IAP-205s and needed LDAP integration. Using the above configuration there were some additional items needed. I found that I needed the DISPLAY NAME of the admin for the Admin-DN. I had created a user with the first name Aruba and the last name LDAP. This made the DISPLAY NAME "Aruba LDAP". This is what needs to be in the CN= for the Admin-DN.I also found there is a difference in using the CN= and OU=Currently our admin account is in the Users group which is a “Container”. Our actual user accounts are stored in an Orginizational Unit with sub OUs as well. So the Admin-DN needed the CN=Users and the Base-DN needed the OU=MyUserOU.For the windows machines I had to download and install the Aruba GTC Shim because the customer was previously using GTC and they were not going to a RADIUS server at the moment. My Android phone and IPHONE did not need any additional addins for the authentication.  The windows laptop I am using I needed to manually create a wireless profile with… Security Tab >“Choose a network authentication method:”Microsoft: Protected EAP (PEAP)Settings >Select “Trusted Root Certification Authorities”GeoTrust Global CASelect Authentication Method:EAP-Token (This is the Aruba GTC Shim) This allowed me to use my domain login credentialsUsernamePasswordDomain (This is blank because the Base-DN already has this, if anything is put in here the authentication fails)