Authentication Methods Overview
Routing Director can authenticate users by using different authentication methods.
You can use one of the authentication methods that are listed in this topic to log in to the Routing Director Web GUI.
Username and Password Authentication
Users can create a Routing Director account to access the Routing Director Web GUI.
In the username and password authentication, a user enters the log in credentials in the Login page of Routing Director. Routing Director authenticates the identity of users by verifying the login credentials (username and password) entered by the users against the information stored in Routing Director database. This ensures that only users with valid credentials access Routing Director. For more information, see User Activation and Login.
Single Sign-On
Routing Director can authenticate users by using single sign-on (SSO). SSO simplifies password management for users and administrators through centralized authentication by an identity provider (IdP) (for example, OpenLDAP, Microsoft Active Directory, and JumpCloud).
A superuser can configure IdP in the Organization Settings page and map default roles in Routing Director to the IdP user groups. Routing Director supports Secure Assertion Markup Language (SAML 2.0) for SSO authentication using IdPs and Lightweight Directory Access Protocol (LDAP). The IdP asserts a user's identity and allows the user to access the Web GUI based on the user's role.
To configure SSO in Routing Director:
Add the IdP to Routing Director; see Manage Identity Providers.
Map users logging in by using the IdP account credentials to the predefined roles in Routing Director; see Manage Roles.
An SSO login can be of two types: IdP-initiated and Service Provider (SP- initiated.
When using IdP-initiated login, a user must log in to the IdP and click or select the application they want to access. The IdP sends the authentication request as an XML-based SAML assertion to Routing Director. The user is logged in to Routing Director if Routing Director accepts the SAML assertion. Otherwise, the user's log in attempt to Routing Director fails.
When using SP-initiated login, the user accesses the Login page of Routing Director to enter their credentials. Routing Director redirects the authentication request to the IdP, to which the IdP responds with a SAML assertion. Routing Director accepts the SAML assertion from the IdP and logs in the user.
If SSO is enabled, ensure that you use IdP-initiated login to log in to Routing Director. Using SP-initiated login will result in an error.
To sign in using SSO for the first time:
User must enter the SSO URL in a browser.
The login screen of the IdP appears.
IdP server authenticates the user based on the sign-in method configured. For example, an approval notification is sent to the user's registered device.
After the IdP server successfully authenticates the user, the user is logged in to the Routing Director Web GUI. Routing Director enforces access control on the user based on the role that the Routing Director superuser previously assigned for the IdP user group to which the user belongs.
Once a user is successfully authenticated, the user can avoid the process of repeated logins to access the Routing Director Web GUI. The user remains signed in until the authentication session expires.
RADIUS Authentication and Authorization
In this release, RADIUS authentication and authorization support is limited to configuring RADIUS on new devices onboarded to Routing Director and authenticating and authorizing the device during onboarding.
By using RADIUS, you can onboard devices by using credentials of users configured in a RADIUS server.
To use RADIUS, you (superuser) must:
Install at least one RADIUS server in your network.
Enable RADIUS authentication in Routing Director.
Configure Routing Director to use the RADIUS server.
By default, local authentication is used when adopting a device. See Adopt a Juniper Device. The adoption commands create a local user on the device, using generated credentials. On first SSH connection with the device, Routing Director updates the local password on the device with a newly generated credential.
When you enable RADIUS, Routing Director provides a set of outbound SSH commands to configure RADIUS on the device. After the device connects to Routing Director during onboarding, the device connects with the RADIUS server to authenticate the credentials provided by Routing Director.
To enable and configure a RADIUS server in Routing Director, see Manage RADIUS Server Configurations.