HP StorageWorks 2/16V HP StorageWorks Fabric OS 5.3.x administrator guide (569 - Page 74

RADIUS configuration and admin domains When configuring users with Admin Domains, you must also include the Admin Domain member list. This section describes the way that you configure attribute types for this configuration. The values for the new attribute types use the syntax key=val[;key=val], where key is a text description of attributes, value is the attribute value for the given key, = is the separator between key and value, and ; is an optional separator for multiple key-value pairs. Multiple key-value pairs can appear for one Vendor-Type code. Key-value pairs with the same key name may get concatenated across multiple Vendor-Type code. You can use any combination of the Vendor-Type codes to specify key-value pairs. Note that a switch always parses these attributes from Vendor-Type code 2 to Vendor-Type code 4. Only two kinds of keys are accepted, HomeAD and ADList. All other keys are ignored. • HomeAD is the designated home Admin Domain for the account. The valid value is between 0 to 255, inclusive. The first valid HomeAD key-value pair is accepted by the switch, and any additional HomeAD key-value pairs are ignored. • ADList is a comma-separated list of Administrative Domain numbers to which this account is a member. Valid numbers are between 0 to 255, inclusive. A dash between two numbers specifies a range. Multiple ADList key-value pairs within the same or across the different Vendor-Type code are concatenated. Multiple occurrence of the same AD number is ignored. RADIUS authentication requires that the account have a valid role through the attribute type Brocade-Auth-Role. The additional attribute values ADList and HomeAD are optional. If they are unspecified, the account can login with AD0 as its member list and home Admin Domain. If there is an error in ADList or HomeAD specification, the account cannot login until the AD list is corrected; an error message is displayed. For example, on a Linux FreeRadius Server, the user (user-za) with the following settings takes the "ZoneAdmin" role, with AD member list: 1, 2, 4, 5, 6, 7, 8, 9, 12; the Home Admin Domain will be 1. user-za Auth-Type := Local, User-Password == "password" Brocade-Auth-Role = "ZoneAdmin", Brocade-AVPairs1 = "ADList=1,2,6, Brocade-AVPairs2 = "ADList=4-8;ADList=7,9,12" In the next example, on a Linux FreeRadius Server, the user takes the "Operator" role, with ADList 0 and homeAD 0. user-opr Auth-Type := Local, User-Password == "password" Brocade-Auth-Role = "operator", Brocade-AVPairs1 = "ADList=1,2;HomeAD=2", Brocade-AVPairs2 = "ADList=-4-8,20;ADList=7,9,12", Setting up RADIUS AAA service Fabric OS 3.2, 4.4.0, and later support RADIUS Authentication, Authorization, and Accounting service (AAA). When configured for RADIUS, a switch becomes a RADIUS client. In this configuration, authentication records are stored in the RADIUS host server database. Login and logout account name, assigned role, and time-accounting records are also stored on the RADIUS server for each user. By default, RADIUS service is disabled, so AAA services default to the switch local database. To enable RADIUS service, it is strongly recommended that you access the CLI through an SSH connection so that the shared secret is protected. Multiple login sessions can configure simultaneously, and the last session to apply a change leaves its configuration in effect. After a configuration is applied, it persists after a reboot or an HA failover. The configuration is chassis-based, so it applies to all logical switches (domains) on the switch and replicates itself on a standby CP blade, if one is present. It is saved in a configuration upload and applied in a configuration download. You should configure at least two RADIUS servers so that if one fails, the other will assume service. You can set the configuration with both RADIUS service and local authentication enabled so that if all RADIUS 76 Managing user accounts