You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/operator-nexus/howto-setup-break-glass-access-.md
+42-96Lines changed: 42 additions & 96 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,13 +21,30 @@ For Network Fabric environments, the current break-glass model, known as Method
21
21
22
22
-**Enhanced security**: Unauthorized access attempts are logged for audit and investigation purposes.
23
23
24
-
## Prerequisites for upgrading or installing runtime version 4.0.0
24
+
## FIDO2 token
25
25
26
-
With the installation or upgrade to Runtime Fabric version 4.0.0, **MethodDV2.0** is enabled by default, enhancing security for BreakGlass access on on-premises network devices. Follow these steps to ensure secure and effective access control.
26
+
In the Method D v2.0 model, break-glass users are issued a FIDO2 token to create and upload a public key linked to their Entra identity. This provides secure SSH access to Fabric devices. Entra RBAC manages authorization, allowing administrators to assign appropriate access levels to users or teams.
For offline accessibility, usernames, public keys, and permissions are pre-provisioned on all Fabric devices, allowing break-glass SSH login without requiring an active Azure connection.
29
29
30
-
Customers must register the **Microsoft.NexusIdentity** user resource provider on their subscription.
30
+
Each FIDO2 token serves as a physical USB device, typically with a fingerprint reader, offering unphishable, multi-factor authentication through user presence and PIN verification.
31
+
32
+
## Method D v2.0 setup and operations
33
+
34
+
This guide is divided into two sections
35
+
36
+
1. **MethodDV2 infrastructure setup** - Mandatory for both existing and new NF deployments running Runtime Fabric version 4.0.0.
Register the **Microsoft.NexusIdentity** resource provider.
31
48
32
49
1. Register the resource provider:
33
50
@@ -43,121 +60,50 @@ Customers must register the **Microsoft.NexusIdentity** user resource provider o
43
60
44
61
The registration status should display as **"Registered"**.
45
62
46
-
### Step 2: Assign necessary permissions for Network Fabric access
63
+
####Step 2: Assign necessary permissions for Network Fabric access
47
64
48
-
As part of the **Secure Future Initiative (SFI)**, **On-Behalf-Of (OBO) tokens** are now required to grant access to customer resources. This token provides **reader permissions** to Microsoft’s 1P service for the Network Fabric instance, allowing access to NNF built-in roles assigned to BreakGlass users. Assign the following permissions to the end-user for Create, Read, Update, and Delete (CRUD) operations on Network Fabric (NF) resources.
65
+
As part of the **Secure Future Initiative (SFI)**, **On-Behalf-Of (OBO) tokens** are now required to grant access to customer resources. This token grants NexusIdentity permissions scoped at the subscription, resource group, or network fabric level to enable **read access**to Network Fabric role assignments. The following role permissions should be assigned to end users or groups responsible for NF create, NF upgrade, and NF delete operations. These permissions can be granted temporarily, limited to the duration required to perform these operations.
49
66
50
-
#### Required permissions
67
+
#####Required permissions
51
68
52
-
1.`Microsoft.NexusIdentity/identitySets/read`
53
-
2.`Microsoft.NexusIdentity/identitySets/write`
54
-
3.`Microsoft.NexusIdentity/identitySets/delete`
69
+
1. Microsoft.NexusIdentity/identitySets/read
70
+
2. Microsoft.NexusIdentity/identitySets/write
71
+
3. Microsoft.NexusIdentity/identitySets/delete
55
72
56
-
#### Configure Azure RBAC for NexusIdentityRP
73
+
74
+
##### Configure Azure RBAC for Network Fabric Runtime version 4.0.0
57
75
58
76
1. Under **Privileged Administrator Roles**, select **Azure RBAC Administrator** as the built-in role and click **Next**.
59
77
60
78
:::image type="content" source="media/breakglass-role-assignment.png" alt-text="Screenshot of adding role-assignment":::
61
79
62
-
2. In the **Members** tab, add **NexusIdentityRP** with the following details:
2. In the **Members** tab, add the identity of the user or security group responsible for performing NF create, update, and delete operations.
67
81
68
82
:::image type="content" source="media/breakglass-add-member-nexusidenitityrp.png" alt-text="Screenshot of adding member to role assignment":::
69
83
70
84
3. In the **Conditions** tab, select "Allow users to only assign selected roles to selected principals (fewer privileges).
71
85
72
86
:::image type="content" source="media/breakglass-conditions-roles-assignment.png" alt-text="Screenshot of adding member to role assignment":::
73
87
74
-
3. Edit Conditions then assign:
88
+
- Select Constrain roles and principals and click Configure,
75
89
76
-
-**Role:** Reader
90
+
-Select the following parameters:
77
91
78
-
-**Principal:** NexusIdentityRP
92
+
**Role:** Reader
93
+
94
+
**Principal:** NexusIdentityRP
79
95
80
96
:::image type="content" source="media/breakglass-constrain-roles-principals.png" alt-text="Screenshot of adding roles and principals":::
81
97
82
-
4. Click **Save** to finalize the configuration.
83
-
84
-
### Deployment scenario permissions
85
-
86
-
-**New deployment scenarios:** Grant constrained delegated permissions at the **resource group scope**.
87
-
88
-
-**Existing deployment scenarios:** Grant constrained delegated permissions at the **Network Fabric scope**.
89
-
90
-
>[!NOTE] These steps are required for creating, deleting, or upgrading Network Fabric to runtime version 4.0.0, even if MethodDV2.0 is not utilized. Failure to complete these steps will cause CRUD operations to fail.
91
-
92
-
#### Additional Prerequisites for Method DV2.0
93
-
94
-
To use Method DV2.0, complete the following setup steps on the end-user machine:
95
-
96
-
1.**Python requirement**
97
-
98
-
Ensure that Python version 3.11 is installed on the end-user machine.
99
-
100
-
2.**Azure CLI requirement**
101
-
102
-
- If Azure CLI is not installed, download and install the latest 64-bit MSI installer.
103
-
104
-
- If Azure CLI is already installed, upgrade to version 2.61 or higher.
105
-
106
-
> [!NOTE]
107
-
> Only the 64-bit Azure CLI installer is supported, as certain Python packages required by Method DV2.0 are incompatible with the 32-bit version.
108
-
109
-
## Setting Up Method D v2.0 for break-glass access
110
-
111
-
### Step 1: Configure FIDO-2 token and register the public key in Microsoft Entra
112
-
113
-
To set up secure access, users need a FIDO-2 hardware token, which provides unphishable multi-factor authentication using both a fingerprint and a personal PIN.
114
-
115
-
1.**Connect the FIDO-2 token**: Insert the FIDO-2 token into your computer.
116
-
117
-
2.**Run the AZ CLI command**: Log in to your Azure account and execute the following command:
118
-
119
-
```Azure CLI
120
-
az nexusidentity gen-keys
121
-
```
122
-
This command, available from Azure CLI 2.65.0, detects the attached hardware token, prompts for a fingerprint scan and PIN, and stores the public key in your Entra account.
123
-
124
-
> [!NOTE]
125
-
> Re-run this command anytime you need to refresh your break-glass credentials.
126
-
127
-
### Step 2: Assign break-lgass permissions to a Network Fabric instance
128
-
129
-
With assistance from Microsoft, customer administrators can assign one of two roles scoped to a specific Network Fabric instance:
130
-
131
-
-**Nexus Network Fabric Service reader**: Allows users to view configuration but restricts access to modification commands.
132
-
133
-
-**Nexus Network Fabric Service writer**: Provides permission to modify the running configuration.
134
-
135
-
These roles match permissions provided under the TelcoRO and TelcoRW accounts in Method D v1.5.
136
-
137
-
After assigning read or write access, usernames and public keys are synced across all devices within the instance. This sync occurs within a four-hour window or can be triggered immediately by running a Nexus Network Fabric reconcile operation.
138
-
139
-
### Day-to-day break-glass access workflow
140
-
141
-
To log into a Fabric device:
142
-
143
-
1.**Connect FIDO-2 token**: Ensure the FIDO-2 token is plugged into your computer.
144
-
145
-
2.**Log In with SSH**: Use one of the following methods:
4. Click Review + Assign to finalize the configuration.
152
99
153
-
> [!NOTE]
154
-
> This command authenticates first on the jump server, then on the Fabric device.
100
+
5. Activate role
155
101
156
-
- **Indirect access using SSH-agent forwarding**:
102
+
-To activate the role, select **Role Based Access Control Administrator** from Eligible assignments tab.
157
103
158
-
First, connect to the jump server and then SSH into the Fabric device. SSH-agent forwarding relays authentication requests to your local machine, using the token to complete the process.
104
+
>[!NOTE:]
105
+
>Ensure that **Role Based Access Control Administrator** is sucessfully activated.
159
106
160
-
3. **Authenticate**: During authentication, you’ll be prompted to verify via fingerprint and PIN, ensuring robust security.
107
+
## Next Steps
161
108
162
-
> [!Fallback]
163
-
> Method D v1.5 remains available as a fallback for emergency access if Method D v2.0 is temporarily unavailable.
109
+
[How to use break-glass access](howto-use-break-glass-access.md)
title: How to use Method D v2.0 secure break-glass access
3
+
description: Process of using Method D v2.0 Breakglass access
4
+
author: sushantjrao
5
+
ms.author: sushrao
6
+
ms.service: azure-operator-nexus
7
+
ms.topic: how-to
8
+
ms.date: 11/04/2024
9
+
ms.custom: template-how-to, devx-track-azurecli
10
+
---
11
+
12
+
# Method D v2.0 Breakglass Access
13
+
Breakglass access using Method D v2.0 is a streamlined approach for administrators to grant secure, emergency access to critical network fabric devices. This guide will walk you through setting up and using Breakglass access, including generating SSH keys, granting permissions, and accessing network fabric devices.
14
+
15
+
# How to Use Method D v2.0 Breakglass Access
16
+
17
+
Breakglass access using Method D v2.0 is a streamlined approach for administrators to grant secure, emergency access to critical network fabric devices. This guide will walk you through setting up and using Breakglass access, including generating SSH keys, granting permissions, and accessing network fabric devices.
18
+
19
+
---
20
+
21
+
## 1. Generating SSH Keys Using the Nexusidentity az CLI
22
+
23
+
To start with Breakglass IAM configuration, you’ll need to set up SSH keys using the Nexusidentity CLI. Make sure you have the following prerequisites installed and updated.
24
+
25
+
### Prerequisites
26
+
27
+
-**Windows Computer** with PowerShell
28
+
-**OpenSSH**: Version 9.4 or higher
29
+
-**Python**: Version 3.11 or higher (64-bit)
30
+
-**AZ CLI**: Version 2.61 or higher (64-bit)
31
+
-**Nexusidentity Extension**: This extension must be added to AZ CLI.
32
+
33
+
### Steps to Install Nexusidentity Extension and Generate SSH Keys
34
+
35
+
1.**Open PowerShell**:
36
+
37
+
>[!Note:]
38
+
>Use non-admin mode for this process.
39
+
40
+
2.**Update AZ CLI**:
41
+
42
+
- Run the following command to update Azure CLI to the latest version:
43
+
44
+
```Azure CLI
45
+
az upgrade
46
+
```
47
+
48
+
3. **Install Nexusidentity extension**:
49
+
50
+
- To add the Nexusidentity extension
51
+
52
+
```Azure CLI
53
+
az extension add --name nexusidentity
54
+
```
55
+
56
+
4. **Generate SSH Keys with Nexusidentity**:
57
+
58
+
a. Download the [Yubico Key Manager](https://www.yubico.com/support/download/yubikey-manager) to reset your YubiKey for initial setup.
59
+
60
+
b. Attach your **YubiKey** to your computer.
61
+
62
+
c. Log in to Azure with:
63
+
64
+
```Azure CLI
65
+
az login
66
+
```
67
+
68
+
d. Run the following command to generate SSH keys:
69
+
70
+
```Azure CLI
71
+
az nexusidentity gen-keys
72
+
```
73
+
74
+
e. During this process:
75
+
76
+
- If prompted to overwrite keys, press **Enter**.
77
+
78
+
- Select the **Security Key** in the popup window and follow the prompts.
79
+
80
+
- Enter your **YubiKey PIN** and touch the device when prompted.
81
+
82
+
- If prompted to enter a passphrase, press **Enter**.
83
+
84
+
f. After successful key generation, you should see:
85
+
86
+
```
87
+
Successfully uploaded public key to Microsoft Entra Id account {user.mail}
88
+
```
89
+
90
+
## Granting break-glass permissions to an Entra user on a Network Fabric
91
+
92
+
To enable Breakglass access for an Entra user on a network fabric, assign the appropriate roles to the user. Below are the role options and their permissions:
93
+
94
+
- **Nexus Network Fabric Service Reader**:
95
+
96
+
- Allows the user to execute show commands on fabric devices.
97
+
98
+
- Does not permit access to configuration mode.
99
+
100
+
- **Nexus Network Fabric Service Writer**:
101
+
102
+
- Allows show commands as well as commands to modify the running configuration.
103
+
104
+
Once these roles are assigned, the corresponding username and public SSH key will be automatically provisioned across all devices within the designated fabric instance.
105
+
106
+
> [Note:] Breakglass user accounts are reconciled every 4 hours. For immediate reconciliation, open a support ticket with the network fabric support team.
107
+
108
+
## 3. Using break-glass access
109
+
110
+
Once permissions are granted, users can access network fabric devices with their FIDO-2 hardware token (e.g., YubiKey). Follow the steps below to use Breakglass access.
111
+
112
+
1. **Prepare for access**:
113
+
114
+
- Make sure your **FIDO-2 hardware token** is plugged into your computer.
115
+
116
+
2. **Use SSH with the `-J` option**:
117
+
118
+
- The `-J` option enables you to log in through a jump server and access a fabric device directly. This involves authentication through both the jump server and the fabric device using SSH keys.
119
+
120
+
Use the following command format to access a fabric device:
0 commit comments