HP StorageWorks 8/80 HP StorageWorks Fabric OS 6.2 administrator guide (5697-0 - Page 87

After you have completed the dictionary file, define the role for the user in a configuration file. For example, to grant the user jsmith the Admin role, you would add the following statement to the configuration file: swladmin Auth-Type := Local, User-Password == "myPassword" Brocade-Auth-Role = "admin", Brocade-AVPairs1 = "HomeLF=70", Brocade-AVPairs2 = "LFRoleList=admin:2,4-8,70,80,128;ChassisRole=admin", Brocade-Passwd-ExpiryDate = "11/10/2008", Brocade-Passwd-WarnPeriod = "30" RADIUS configuration with Admin Domains or Virtual Fabrics When configuring users with Admin Domains or Virtual Fabrics, you must also include the Admin Domain or Virtual Fabric member list. This section describes the way that you configure attribute types for this configuration. The values for the new attribute types use the syntax key=val[;key=val], where key is a text description of attributes, value is the attribute value for the given key, the equal sign (=) is the separator between key and value, and the semicolon (;) is an optional separator for multiple key-value pairs. Acceptable keys Multiple key-value pairs can appear for one Vendor-Type code. Key-value pairs with the same key name may be concatenated across multiple Vendor-Type codes. You can use any combination of the Vendor-Type codes to specify key-value pairs. Note that a switch always parses these attributes from Vendor-Type code 2 to Vendor-Type code 4. Only four kinds of keys are accepted; all other keys are ignored. The following keys are accepted: • HomeAD is the designated home Admin Domain for the account. The valid value is between 0 to 255, inclusive. The first valid HomeAD key-value pair is accepted by the switch, and any additional HomeAD key-value pairs are ignored. • ADList is a comma-separated list of Administrative Domain numbers of which this account is a member. Valid numbers range from 0 to 255, inclusive. A dash between two numbers specifies a range. Multiple ADlist key-value pairs within the same or across the different Vendor-Type codes are concatenated. Multiple occurrences of the same Admin Domain number are ignored. • HomeContext is the designated home Virtual Fabric for the account. The valid values are between 1 to 128 and chassis context. The first valid HomeContext key-value pair is accepted by the switch, Additional HomeContext key-value pairs are ignored. • ContextRoleList is a comma-separated list of Virtual Fabric ID numbers of which this account is a member. Valid numbers range from 1-128, inclusive. A dash between two numbers specifies a range. Multiple VFlist key-value pairs within the same or across the different Vendor-Type codes are concatenated. Multiple occurrences of the same VF ID number are ignored. RADIUS authentication RADIUS authentication requires that the account have a valid role through the attribute type Brocade-Auth-Role. The additional attribute values ADList, HomeAD, HomeContext, and ContextRoleList are optional. If they are unspecified, the account can log in with AD0 as its member list and home Admin Domain or VF128 as its member list and home Virtual Fabric. If there is an error in the ADlist, HomeAD, VFlist, or Home Context specification, the account cannot log in until the AD list or VF list is corrected; an error message is displayed. For example, on a Linux FreeRadius Server, the user (user-za) with the following settings takes the "zoneAdmin" role, with AD member list: 1, 2, 4, 5, 6, 7, 8, 9, 12; the Home Admin Domain will be 1. user-za Auth-Type := Local, User-Password == "password" Brocade-Auth-Role = "ZoneAdmin", Brocade-AVPairs1 = "ADList=1,2,6," Brocade-AVPairs2 = "ADList=4-8;ADList=7,9,12" Fabric OS 6.2 administrator guide 87