"you can define additional user attributes that can be then be defined values for each user. These can be similarly used to classify users and define policies based on these values"
What are you referring to?
We have different sets of Network Device groups (i.e. firewalls, routers, switches). We want certain internal users to have varying degrees of access to these device types. Some users would have only non-enable access to switches. Some have non-enable to both switches and router, but no firewall access whatsoever. Some enable access to switches, RO to routers, no access to Firewalls. Some users would need enable access to routers and switches, but non-enable access to firewalls. Firewall auditors have access to only firewalls. The complication is where the user would have different roles from the other users. Not everyone in our organization is supposed to be an admin to every device type, but might need read-only to other types of devices.
This could be so simple and easy to configure if ACS would allow users to be members of multiple groups. The concept of users being members of multiple groups within access control systems within IT infrastructures has been around for about 4 decades now, why not in ACS?
