topic Re: attribute definition syntax in Network Access Control

attribute definition syntax

xine xine — Mon, 11 Mar 2019 00:37:14 GMT

Hi !

I planned to migrate our MDS switches to TACACS+ for AAA services. I the documentation I find some different way to defining attributes :

http://www.cisco.com/en/US/docs/storage/san_switches/mds9000/sw/rel_2_x/fm/configuration/guide/radius.html#wp1224864

shell:roles="network-admin"

shell:roles*"network-admin"

cisco-av-pair*shell:roles="network-admin"

cisco-av-pair*shell:roles*"network-admin"

cisco-av-pair=shell:roles*"network-admin"

what is difference between those syntaxe ?

Re: attribute definition syntax

Javier Henderson — Mon, 29 Nov 2010 20:18:07 GMT

Whether you put shell: or cisco-av-pair: depends on the RADIUS server.

The * instead of the = makes the attribute optional rather than mandatory. This will have relevance if those attributes will be sent to all devices in which the user logs in, in that case you will want to make the attributes optional or the device might fail authorization if it doesn't know what to do with a mandatory attribute (IOS, for example, will fail authorization if it receives a role assignment as mandatory).