TACACS auth working via SSH, but not HTTP (ACS 5.1 / 3560)

Experts,
My switches are able to successfully authenticate user access against ACS 5.1 via SSH with TACACS+, but I am not able to authenticate via HTTPS with TACACS+. I don't even get a log in ACS when attempting to authenticate via HTTPS.
Here is my AAA config, followed by a debug:
aaa new-model
aaa authentication login ACCESS group tacacs+ local
aaa authorization console
aaa authorization config-commands
aaa authorization exec ACCESS group tacacs+
aaa authorization commands 1 Priv1 group tacacs+ none
aaa authorization commands 15 Priv15 group tacacs+ none
aaa authorization network ACCESS group tacacs+
aaa accounting exec ACCESS start-stop group tacacs+
aaa accounting commands 0 ACCESS start-stop group tacacs+
aaa accounting commands 1 ACCESS start-stop group tacacs+
aaa accounting commands 15 ACCESS start-stop group tacacs+
aaa session-id common
ip http authentication aaa login-authentication ACCESS
ip http authentication aaa exec-authorization ACCESS
ip http authentication aaa command-authorization 1 Priv1
ip http authentication aaa command-authorization 15 Priv15
ip http secure-server
no ip http server
tacacs-server host X.X.X.X key 7
tacacs-server timeout 3
tacacs-server directed-request
Debug:
47w4d: HTTP AAA Login-Authentication List name: ACCESS
47w4d: HTTP AAA Exec-Authorization List name: ACCESS
47w4d: HTTP: Authentication failed for level 15
Shell authorization profiles are working in ACS when SSHing to devices (Priv1 and Priv15), and I can't figure out why its not working for HTTPS.
Any ideas?

Thank you for your response, here is the debug from the 3560:
BC-3560-48-6-1-1#
48w0d: HTTP AAA Login-Authentication List name: ACCESS
48w0d: HTTP AAA Exec-Authorization List name: ACCESS
48w0d: TPLUS: Queuing AAA Authentication request 0 for processing
48w0d: TPLUS: processing authentication start request id 0
48w0d: TPLUS: Authentication start packet created for 0(varnumd)
48w0d: TPLUS: Using server 10.10.0.16
48w0d: TPLUS(00000000)/0/NB_WAIT/458EDA8: Started 3 sec timeout
48w0d: TPLUS(00000000)/0/NB_WAIT: socket event 2
48w0d: TPLUS(00000000)/0/NB_WAIT: wrote entire 27 bytes request
48w0d: TPLUS(00000000)/0/READ: socket event 1
48w0d: TPLUS(00000000)/0/READ: Would block while reading
48w0d: TPLUS(00000000)/0/READ: socket event 1
48w0d: TPLUS(00000000)/0/READ: read entire 12 header bytes (expect 16 bytes data)
48w0d: TPLUS(00000000)/0/READ: socket event 1
48w0d: TPLUS(00000000)/0/READ: read entire 28 bytes response
48w0d: TPLUS(00000000)/0/458EDA8: Processing the reply packet
48w0d: TPLUS: Received authen response status GET_PASSWORD (8)
48w0d: TPLUS: Queuing AAA Authentication request 0 for processing
48w0d: TPLUS: processing authentication continue request id 0
48w0d: TPLUS: Authentication continue packet generated for 0
48w0d: TPLUS(00000000)/0/WRITE/4332F88: Started 3 sec timeout
48w0d: TPLUS(00000000)/0/WRITE: wrote entire 30 bytes request
48w0d: TPLUS(00000000)/0/READ: socket event 1
48w0d: TPLUS(00000000)/0/READ: read entire 12 header bytes (expect 6 bytes data)
48w0d: TPLUS(00000000)/0/READ: socket event 1
48w0d: TPLUS(00000000)/0/READ: read entire 18 bytes response
48w0d: TPLUS(00000000)/0/4332F88: Processing the reply packet
48w0d: TPLUS: Received authen response status PASS (2)
48w0d: TPLUS: Queuing AAA Authorization request 0 for processing
48w0d: TPLUS: processing authorization request id 0
48w0d: TPLUS: Inappropriate protocol: 25
48w0d: TPLUS: Sending AV service=shell
48w0d: TPLUS: Sending AV cmd*
48w0d: TPLUS: Authorization request created for 0(varnumd)
48w0d: TPLUS: Using server 10.10.0.16
48w0d: TPLUS(00000000)/0/NB_WAIT/4332E18: Started 3 sec timeout
48w0d: TPLUS(00000000)/0/NB_WAIT: socket event 2
48w0d: TPLUS(00000000)/0/NB_WAIT: wrote entire 46 bytes request
48w0d: TPLUS(00000000)/0/READ: socket event 1
48w0d: TPLUS(00000000)/0/READ: Would block while reading
48w0d: TPLUS(00000000)/0/READ: socket event 1
48w0d: TPLUS(00000000)/0/READ: read 0 bytes
48w0d: TPLUS(00000000)/0/READ/4332E18: timed out
48w0d: TPLUS: Inappropriate protocol: 25
48w0d: TPLUS: Sending AV service=shell
48w0d: TPLUS: Sending AV cmd*
48w0d: TPLUS: Authorization request created for 0(varnumd)
48w0d: TPLUS(00000000)/0/READ/4332E18: timed out, clean up
48w0d: TPLUS(00000000)/0/4332E18: Processing the reply packet
48w0d: HTTP: Authentication failed for level 15

Similar Messages

UCSM via SSH but not HTTP(s)

I cannot load the webpage for my UCS via the cluster IP which was working before a full power down. I can SSH to the cluster IP and see things, but the web site and the GUI aplpication no longer work. I tried a second power cycle to no avail and I have gone in to disable / enable the http and https services, again to no avail.
I'm lost as what might be wrong.
-Ryan

Hi Ryan,
Since you can SSH to the UCSM, can you also connect to the local-mgmt of both the FIs and run the following command to make sure the HTTP service is running
FI-A(local-mgmt)# show pmon state
Sample good outout
BGL-SV-UCS-TEST-B(local-mgmt)# show pmon state
SERVICE NAME             STATE     RETRY(MAX)    EXITCODE    SIGNAL    CORE
svc_sam_controller     running           0(4)           0         0      no
svc_sam_dme            running           0(4)           0         0      no
svc_sam_extvmmAG       running           0(4)           0         0      no
httpd.sh               running           0(4)           0         0      no   <<<<< running service
svc_sam_sessionmgrAG   running           0(4)           0         0      no
Make sure to check this on both the FI.
./Abhinav

DB Link - works via SQL but not via packages

I have a database link on user ODB on database A, to database B. The DB Link seems fine for SQLs that i do, but doesn't compile in my package code. Please tell me why it works for "regular sqls" but not inside a package.
Example: while connected as ODB user on database A, if I do this query:
SELECT "TRAXDOC_DETAIL"."FILE_NAME",
"TRAXDOC_DETAIL"."FILE_TYPE",
FROM "TRAXDOC_DETAIL"@TRAXDOC_LINK
WHERE "TRAXDOC_DETAIL"."TRAXDOC_ROW_ID" = 100031 AND
"TRAXDOC_DETAIL"."TRAXDOC_LINE"= 2
It works fine. But the same query inside a package that is owned by user ODB on database A will not compile, stating the table/view does not exist.
The database link is owned by use ODB on database A, connects directly to the owner of the tables in question on database B.
Any suggestions welcome... this is an urgent issue, because it also worked fine on my customer's test environment, but not on their Production that they just upgraded. I need to know what to look for as to what could be wrong.

Thanks so much for your response - Prefixing the call to the table within the package, with the schema owner does indeed solve the problem. Since this is a Production issue, i have implemented this fix in my customer's database.
However, I would still like this issue permanently resolved. The next time we send out updated package code, this will happen again (unless we then fix it again). I'd still like info from anyone on what exactly must be done to allow the call within the package to work without specifically pre-fixing the table's schema owner. It shouldn't be needed... The DB link is connecting via the same schema on database B that owns the table in question.
pre-fixing the schema owner is something we don't do in our sql statements, and this has worked fine for many of our cusomer's environments. We're only seeing this issue on one environment.

Personal hotspot working via BlueTooth but NOT working via wi-fi

Hi,
Would appreciate some help with this! Using an iPhone 4, just upgraded to iOS 4.3, and trying to get personal hotspot working.
Basically, see subject ^ .. I can't get it working. Devices (I've tried iMac, iPad) can see the wireless network created by the iPhone, begins to connect (and appearing connected, from the iPhone) but isn't actually online. Though, I was able to pair my computer and phone and create a network connection via personal hotspot that way. But I want to use wifi, and let others use it...
I'm on Bell Mobility in Canada. Any help greatly appreciated!
Chris

Hi lofive,
Welcome to Apple Support Communities.
It sounds like you’re running into an issue with devices not being able to connect to a Personal Hotspot created by your iPhone. Try the suggestions in the article linked below, it provides a lot of great troubleshooting tips that will resolve most issues like the one you’ve described.
iOS: Troubleshooting Personal Hotspot
I hope this helps.
-Jason

Acrobat 9 Form works via email but not uploaded to website

Hi all. I need to be able to have people go to a url, fill out a form and then e-mail it to the company. The e-mailing part works perfectly if I e-mail the form to myself but when it's uploaded to the company's website nothing happens. Is it possible to have it filled out on the website and e-mailed or do I have tobuild a conventional online form to do this? The company already has an attractive form which we'd prefer to use but I'm thinking I need to build a regular html form instead. Could someone please confirm or (hopefully) deny this conclusion? If it IS possible to make the pdf work on a website I'd appreciate any and all clues as to how to do so. Thanks!

If the people are filling out the forms with Reader, unless you set up form in Acrobat to Confer Rights on Reader they won't be able to do wnything with the form and print it. It can't be saved nor can it be meailed and be filled out.
Follow these steps:
Open Acrobat
Open form
Go to advanced menu
Choose extend Features in Reader (as described in Acobat 9.x for Mac).
Once menu choice is open choose what you want to allow.
Make sure you form is perfect because once you confer rights your no longer allowed to edit the form.
you will have go back and may an unrights protected copy; before you can edit the form .
(Please note information is given by an Experienced User of Acrobat. I am not an employee of Adobe.)

I have a macbook pro 13" early 2011 version and what to install windows 7 on it via bootcamp but not sure that whether to install x64 or x86 version? which one will work better

i have a macbook pro 13" early 2011 version and what to install windows 7 on it via bootcamp but not sure that whether to install x64 or x86 version? which one will work better

There is no need for anyone to use 32-bit version anymore.
Retail comes with both. Or you can save on just buying 64-bit System Builder disc.
Better support for today's hardware with larger video graphic memory and systems.
Better memory management.

QTSS Works on Mac but not the other

I have a Server running OS X Server 10.5.8. I am running QTSS and Apache on this machine, however I am having issues with Quicktime streaming. One mac here is able to successfully stream but all other macs on our network fail to connect despite the QTSS "Connections" window shows the connection to the machine trying to stream the video. In the end on the client Quicktime X shows "Not Found" however I am able to connect to the server via other services (ARD, AFP, HTTP). I can post any logs that might help.
Thanks in advance

I couldn't remember what the Display Preferences had said when we tried this last spring and again in the summer, so tonight we connected it again, and wouldn't you know - it worked just fine. We didn't do anything different, so I have no clue as to why it worked this time but not before. He's thinking about getting his own big display, but didn't want to waste his money if he couldn't get it to work, so now I guess we're shopping for another 23" display - probably a used one. Thanks!

Published interactive project works in IE but not in Chrome???

My buttons and interactions are working through an Internet Explorer browser, but loose their functionality when play via Chrome. Anyone have any ideas?

If it works in IE but not FF, then it has nothing to do with the mp3s. More likely it's because of the HTML on the page.
To start, page is missing DOCTYPE declaration... a MAJOR problem. The DOCTYPE declares which set of rules the browser will use to display the page. Without it, different browsers go crazy or do not work at all.
http://www.w3schools.com/tags/tag_DOCTYPE.asp
Validate the html code here:
http://validator.w3.org/
You will have to fix all the errors if you want this to work in all browsers.
Best wishes,
Adninjastrator

Medical app from Intuit works in IE, but not Firefox.

Encrypted medical app works in new IE, but not Firefox. Everything works down to the end, and click on "continue" and nothing happens. A tech and I have spent hours on this. Did not work on FF5 or 6. Did not work on old IE, but did on fresh new version with no data files copied in.

If it works in IE but not FF, then it has nothing to do with the mp3s. More likely it's because of the HTML on the page.
To start, page is missing DOCTYPE declaration... a MAJOR problem. The DOCTYPE declares which set of rules the browser will use to display the page. Without it, different browsers go crazy or do not work at all.
http://www.w3schools.com/tags/tag_DOCTYPE.asp
Validate the html code here:
http://validator.w3.org/
You will have to fix all the errors if you want this to work in all browsers.
Best wishes,
Adninjastrator

Navigation works in IE but not Firefox or Safari!

Hi guys
Why do my nav links on the hompage work in IE but not in Firefox and Safari? http://www.jasonkieck.com/
Any help would be appreciated

The main reason is you have a <div id="bg_grid"> at the end of your html that is essentially over the top of everything else on your page, including your links. All clicks go to that <div> rather than your links undeneath it. I'm kind of surprised it works in IE to be honest.
You do also have a ton of errors as Gramps points out, but that particular issue is not technically an error, so I have a feeling you could fix the ~100 problems shown by the validator and still have the issue.
You could use z-index to "order the stack" as it were. Changing the z-index attributes for the css of those elements will allow you to change their order, regardless of their location in the html. A higher z-index number, the "closer" it is to the viewer (higher on the stack).
Right now, they are both set to 1, so the one that comes later in the html is on top.
Adding z-index:999 to the menu <div> should do it,

Spry menubar works in IE, but not Firefox

I added a very simple Spry horizontal menubar to the top of all pages in my web (I'm using DWCS4 and Spry 1.6). When I preview it in Firefox locally, it seems to work, but when it is uploaded to the web server it works in IE, but not in Firefox. Instead of a menubar, I see a stack of bulleted hyperlinks. In IE, it displays properly.
Website is http://www.stevegoldman.com.
How can I fix this problem so that it works with all browsers properly?
-- Martin

I just tested your site with firefox (latest version) and it works just fine. I also tested it in IE: 7.0 and it worked fine for that too. Looks like you have either fixed the problem or you have a different version of firefox than me or something.
Favorite qoute: "do unto other as you would do unto yourself"
Favorite hobby: airsoft / electric aeg airsoft guns
Airsoft Sniper Rifles

Spry tooltip works in IE but not Firefox

Hi,
I don't understand or can't figure out what I have done wrong. I have created a tooltip for the last product (4 inch diameter Vortex Water Revitalizer in copper (special order)) on the page: http://www.alivewater.net/order.htm
It works in IE but not Firefox... I can't figure out why... can you help me and see what I have done wrong?
Eternally grateful,
Starry

I think I fixed the problem.. maybe you had looked at it after it was fixed. I do appreciate your help though!

Works in IE but not FireFox?

site is here
http://carolyoungs.myartsonline.com/
when i hosted it on a different server it worked in both browsers, now i changed to a different free host because of the mp3 file i have with the site, and some sites will not host mp3 and it only works with IE
can anyone help me out?

If it works in IE but not FF, then it has nothing to do with the mp3s. More likely it's because of the HTML on the page.
To start, page is missing DOCTYPE declaration... a MAJOR problem. The DOCTYPE declares which set of rules the browser will use to display the page. Without it, different browsers go crazy or do not work at all.
http://www.w3schools.com/tags/tag_DOCTYPE.asp
Validate the html code here:
http://validator.w3.org/
You will have to fix all the errors if you want this to work in all browsers.
Best wishes,
Adninjastrator

Sockets work on localhost but not remotely?

hi there,
I have created a simple multithreaded client / server program.
The Server listens on port 2222 for clients. When a client connects - the client sends its ip address to the server and then disconects. More than 1 client can connect at the same time to the server and the server also listens continuasly. I have 2 problems with the program...
a) the programs work on localhost but not on remote machines? (Well not over my LAN anyway).
b) I am getting 2 lots of 'datain' when the server recieves an ip address from the client when the client should only send it once.
The code is below - any help would be greatly appreciated.
//TCPServer.java
import java.io.*;
import java.net.*;
class TCPServer {
     public static void main (String args[]) throws IOException {
          ServerSocket serverSocket = null;
          boolean listening = true;
          try {
               serverSocket = new ServerSocket(2222);
          } catch (IOException e) {
               System.err.println("Could not listen on port: 2222");
               System.exit(-1);
          System.out.println("Server Started...\n");
          while (listening)
          new TCPServerThread(serverSocket.accept()).start();
          serverSocket.close();
//TCPServerThread.java
import java.net.*;
import java.io.*;
public class TCPServerThread extends Thread {
    public Socket socket;
    public TCPServerThread(Socket socket) {
     super("TCPServerThread");
     this.socket = socket;
    public void run() {
               try {
               BufferedReader datain = new BufferedReader (new InputStreamReader
                    (socket.getInputStream()));
                    System.out.println("ip address recieved");
                    System.out.println (datain.readLine () + "\n");
               } catch (IOException e) {
                    System.err.println("Cannot read in ip address\n");
                    e.printStackTrace(); // show the error
                    System.exit(-1);
     } //TCPClient.java
import java.io.*;
import java.net.*;
class TCPClient {
     public static void main (String args[]) throws Exception
          String hostname;
          int portNumber;
          String portString;
          BufferedReader inFromUser =
               new BufferedReader (new InputStreamReader(System.in));
               System.out.println("What host would you like to connect to?");
               hostname = inFromUser.readLine();
               System.out.println("What port would you like to connect to?");
               portString = inFromUser.readLine();
               portNumber = Integer.parseInt(portString);
               System.out.println("Connecting to port " + portNumber + " of " + hostname + "....\n");
                    Socket clientSocket = new Socket(hostname, portNumber);
                    Socket sock = new Socket (InetAddress.getLocalHost(), portNumber);
                    BufferedWriter dataout;
                    java.net.InetAddress i = java.net.InetAddress.getLocalHost();
                    System.out.println("Sending ip address...\n" + i.getHostAddress());
                         dataout = new BufferedWriter (new OutputStreamWriter (sock.getOutputStream()));
                              dataout.write (i.getHostAddress());
                              dataout.flush();
                              sock.close();
                                   clientSocket.close();
                         }Oh, yeah - check out my site below, I am trying to write an audio streaming client / server in Java if anyone is interested in getting involved or just being nosey....
http://www.projectg.dsl.pipex.com

In your client you are creating two sockets (why?). One connected to localhost, the other connected to the host specified using readLine.
If your client runs on the same machine you have started your server, you have two connects to your server instead of one.
The ip adresse is sent using the socket connected to localhost. That is why it does not work on remote machines.
Hope this helps.
Jörg

Mac mini webcam works on facetime but not oovoo

I am using a Rocketfish hd webcam and it is working on facetime but not on oovoo. Can someone provide a solution?

P.S.
If the third-party support info and help does not get it working for you, you can also use OS X Mavericks recovery or reinstall to repair your startup disk or reinstall OS X 10.9.
Also Apple's http://support.apple.com/kb/HT2090
(Over time, Apple has changed the built-in camera's name on newer Macs from "iSight" to "FaceTime" and then to "FaceTime HD." Regardless of the name of your Mac's built-in camera, the same info and troubleshooting applies.)
Message was edited by: EZ Jim
Mac OSX 10.8.5

TACACS auth working via SSH, but not HTTP (ACS 5.1 / 3560)

Similar Messages

Maybe you are looking for