Would you like to learn how to configure an APC UPS to authenticate on the Active directory? In this tutorial, we are going to show you how to authenticate the APC UPS users on the Active Directory database using the Microsoft NPS server.

Hardware List:

The following section presents the list of equipment used to create this APC UPS tutorial.

Every piece of hardware listed above can be found at Amazon website.

APC UPS - Playlist:

On this page, we offer quick access to a list of videos related to the APC UPS.

Don't forget to subscribe to our youtube channel named FKIT.

Tutorial - Radius Server Installation on Windows

• IP - 192.168.15.10.
• Operacional System - Windows 2012 R2
• Hostname - TECH-DC01
• Active Directory Domain: TECH.LOCAL

Open the Server Manager application.

Access the Manage menu and click on Add roles and features.

Windows 2012 add role

Access the Server roles screen, select the Network Policy and Access Service option.

Click on the Next button.

Network Policy and Access Service

On the following screen, click on the Add features button.

network policy features

On the Role service screen, click on the Next Button.

network policy server

On the next screen, click on the Install button.

radius server installation on windows

You have finished the Radius server installation on Windows 2012.

Tutorial Radius Server - Active Directory Integration

Next, we need to create at least 1 account on the Active directory.

The ADMIN account will be used to login on the APC UPS web interface.

On the domain controller, open the application named: Active Directory Users and Computers

Create a new account inside the Users container.

Zabbix active directory account

Create a new account named: admin

Password configured to the ADMIN user: 123qwe..

This account will be used to authenticate as admin on the APC UPS web interface.

active directory admin accountzabbix active directory admin properties

Congratulations, you have created the required Active Directory accounts.

Next, we need to create at least 1 group on the Active directory database.

On the domain controller, open the application named: Active Directory Users and Computers

Create a new group inside the Users container.

Radius Active directory group

Create a new group named: APC-ADMIN

Members of this group will have administrative permission on the APC UPS web interface.

APC UPS Active directory

Important! Add the admin user as a member of the APC-ADMIN group.

APC UPS Active directory authentication

Congratulations, you have created the required Active Directory group.

Tutorial Radius Server - Add Client Devices

On the Radius server, open the application named: Network Policy Server

You need to authorize the Radius server on the Active directory database.

Right-click on NPS(LOCAL) and select the Register server in Active Directory option.

authorize radius server on windows

On the confirmation screen, click on the OK button.

Next, you need to configure Radius clients.

Radius clients are devices that will be allowed to request authentication from the Radius server.

Important! Do not confuse Radius clients with Radius users.

Right click on Radius Clients folder and select the New option.

APC UPS Active directory - Radius client

Here is an example of a Client configured to allow an APC UPS to connect to the Radius server.

You need to set the following configuration:

• Friendly name to the device - Add a description to your UPS.
• Device IP Address - IP address of your UPS.
• Device Shared secret - kamisama123

The Shared secret will be used to authorize the device to use the Radius server.

You have finished the Radius client configuration.

Tutorial Radius Server - Configure a Network Policy

Now, you need to create a Network Polity to allow authentication.

Right click on the Network Policies folder and select the New option.

Enter a name to the network policy and click on the Next button.

nps - network policy name

Click on the Add condition button.

We are going to allow members of the APC-ADMIN group to authenticate.

apc ups radius group - active directory

Select the User group option and click on the Add button.

nps - user group condition

Click on the Add Groups button and locate the APC-ADMIN group.

APC UPS - Active directory group

Select the Access granted option and click on the Next button.

This will allow members of the APC-ADMIN group to authenticate on the Radius server.

NPS Access granted

On the Authentication Methods screen, select the Unencrypted authentication (PAP, SPAP) option.

Radius server authentication method

If the following warning is presented, click on the No button.

NPS Warning message

Select the Vendor Specific radius attribute option and click on the Add button

Microsoft Radius Vendor Specific

Select the Custom vendor option.

Select the Vendor-Specific Attribute and click on the Add button.

Microsoft Radius Vendor Specific Custom

Click on the Add button.

Microsoft Radius attribute information

Set the Vendor Code: 318

Select: Yes, it conforms.

Click on the Configure Attribute button.

APC UPS - Vendor-specific

Set the Vendor-assigned attribute number: 1

Select the Atribute format: Decimal

Enter the Attribute Value: 1

APC UPS - NPS Radius specific attibute

The NPS Radius server will pass the vendor specific information back to the UPS device.

The APC UPS will give the authenticated users administrative permission over the device.

mikrotic active directory vendor specific

Verify the Radius server configuration summary and click on the Finish button.

pfsense active directory authentication summary

Congratulations! You have finished the Radius server configuration.

APC UPS - Radius Authentication on Active Directory

First, we need to access the APC UPS web interface.

Open your browser and enter the IP address of the APC UPS.

On the login screen, use the default username and default password.

• Default Username: apc
• Default Password: apc

APC UPS Web interface

After a successful login, you will be sent to the APC UPS Dashboard.

APC UPS Dashboard

Access the Configuration menu, access the Security menu.

Access the Remote users menu and select the Radius option.

apc radius menu

Select the primary Radius server.

apc radius server

On the RADIUS Server settings area, perform the following configuration:

• Radius Server - 192.168.15.10
• Port - 1812
•  Secret - The Radius Client shared secret (kamisama123)
•  Reply Timeout - 1 Second

You need to change IP address of the Radius server.

You need to change the secret.

To test the Radius authentication, select the test option and enter a user account from the Active directory.

apc radius authentication

After testing the Radius authentication successfully, select the Skip test and apply option.

apc radius authentication configuration

Access the Configuration menu, access the Security menu.

Access the Remote users menu and select the Authentication option.

apc radius authentication menu

Select the option: Radius, then local authentication option.

Click on the Apply button to finish the Radius authentication configuration.

apc radius authentication method

First, the UPS will try to authenticate the users using the Radius server.

If the Radius server is offline, the system will authenticate using the local user accounts.

Congratulations! You have configured the UPS authentication to use the Active directory.

APC UPS - Radius Authentication Test

After finishing the Radius configuration, you should log off the APC web interface.

Try to login using the admin user and the password from the Active directory.

On the login screen, use the admin user and the password from the Active directory.

• Username: admin
• Password: Enter the Active directory password.

APC UPS Web interface

If your test succeeds, you will be sent to the APC UPS Dashboard.

APC UPS Dashboard

Congratulations! You have configured the APC UPS authentication on the Active directory.