You are very welcome Pankaj.
Sure, you should apply authorization along to the authentication and remove the "privilege level 15" command from vty lines. The following configs should do that for you:
aaa new-model
!
!
aaa authentication login default local
aaa authorization exec default local
!
username priv15 privilege 15 secret xxxxxxxxxx
username priv1 secret xxxxxxxxxx
username priv7 privilege 7 secret xxxxxxxxxx
!
line vty 0 4
login authentication default
default authorization exec
no privilege level 15
Now let's try to login with those three users which have different privilege levels and check the privilege level after the successful login with the command "sh priv":
login as: priv15
Using keyboard-interactive authentication.
Password:
Router#sh pri
Current privilege level is 15
login as: priv1
Using keyboard-interactive authentication.
Password:
Router>sh priv
Current privilege level is 1
login as: priv7
Using keyboard-interactive authentication.
Password:
Router#sh privilege
Current privilege level is 7
As you can see, each user is logged in now with its privilege level, so each user would be able to execute only the commands tied to its privilege level, but you would do still be able to prevent a user from executing a command of its privilege level by changing that command privilege exec level, example, if you don't want to allow the users with privilege level below privilege level 8 to execute the "show" command you would do it this way:
privilege exec level 8 show
Now that command is being authorized, so when a user with a privilege level below level 8 logged in and try to execute the "show" command it would not be able to, and an error message similar to this would be returned:
Router#sh priv
^
% Invalid input detected at '^' marker.
Router#sh ip route
^
% Invalid input detected at '^' marker.
Router#
Regards,
Aref
