Nexus Authentication and Authorization¶

Nexus utilizes the authentication configuration available through the User Manager in the pfSense software GUI on the node running the Nexus controller to allow access to the Nexus GUI and API. However, Nexus has additional constraints for user authorization, which means the same accounts may not be able to access both Nexus and the pfSense software GUI without additional configuration.

Local Database Authentication¶

For users authenticating against the Local Database from the pfSense software configuration, members of its built-in admins group can log into Nexus with the same credentials used for pfSense software GUI and have full superuser access. Users who are not members of the admins group can be members of Nexus groups which assign capabilities and roles for fine-grained access.

Remote Authentication Servers¶

For remote authentication servers, such as LDAP, the users authenticating through that remote server must be members of Nexus groups which assign capabilities and roles within Nexus.

Group Authorization Names¶

Group names granting users authorization to Nexus combine the prefix mim_ with an optional capability and mandatory role separated by _, i.e. mim_<capability>_<role> or mim_<role>.

For example, members of a group named mim_read_logs have access to read log data. Omitting the capability implies full access, so members of the mim_logs group have full access to read, modify, and delete logs.

Capabilities¶

Group names can contain the following capabilities:

Nexus User Capabilities¶
Capability	Purpose
`read`	Read data, perform GET API calls
`modify`	Modify data, perform POST, PUT, and PATCH API calls
`delete`	Delete data, perform DELETE API calls
`<empty>`	Full access to the given role (read, modify, delete)

Note

The modify and delete capabilities implicitly enable read access.

Roles¶

Group names can contain one of the following roles:

Nexus User Roles¶
Role Name	Purpose
`none`	No access to Nexus
`user`	User without management access (e.g. VPN user)
`view`	Global view only, no confidential information
`logs`	Log data
`usermgmt`	User management operations
`user_management`	Alias for usermgmt
`services`	Service configuration and control
`firewall`	Firewall and NAT configuration
`interfaces`	Interface configuration
`devices`	Device configuration
`system`	System configuration and console access
`superuser`	Special group equivalent to built-in admins

Note

The mim_superuser group is special in that members of the mim_superuser group have access equivalent to the built-in admins group in the local database.

Group Name Examples¶

Using the given information about forming names, these example group names demonstrate varying levels of Nexus access.

Nexus Group Name Examples¶
Group Name	Capabilities
`mim_superuser`	Full access to all of Nexus
`mim_firewall`	Full access to firewall
`mim_read_interfaces`	Only read interfaces
`mim_delete_logs`	Read and delete logs, but not modify
`mim_modify_services`	Read and modify services, but not delete
`mim_user`	VPN user with no access to Nexus

Troubleshooting¶

The error messages Nexus returns for login failures can vary depending on the source of the problem:

[@login_-L75] invalid credentials for user '<name>': The user attempted to log in with an invalid username or password. It could be that the user does not exist, password is incorrect, or the authentication server rejected the login.
[@login_-L123] unauthorized login: The user credentials were correct, but the user does not have authorization to the resource they attempted to access. Typically, this is because the user is not a member of a group granting authorization to that resource.