HP StorageWorks Fabric OS 5.3.x administrator guide (5697-0244, November 2009)

76 Managing user accounts
RADIUS configuration and admin domains
When configuring users with Admin Domains, you must also include the Admin Domain member list. This
section describes the way that you configure attribute types for this configuration.
The values for the new attribute types use the syntax
key=val[;key=val] , where key is a text description of
attributes,
value is the attribute value for the given key, = is the separator between key and value, and ; is
an optional separator for multiple key-value pairs.
Multiple key-value pairs can appear for one Vendor-Type code. Key-value pairs with the same key name
may get concatenated across multiple Vendor-Type code. You can use any combination of the Vendor-Type
codes to specify key-value pairs. Note that a switch always parses these attributes from
Vendor-Type code
2
to Ve ndor-Type code 4 .
Only two kinds of keys are accepted,
HomeAD and ADList . All other keys are ignored.
• HomeAD is the designated home Admin Domain for the account. The valid value is between 0 to 255,
inclusive. The first valid HomeAD key-value pair is accepted by the switch, and any additional
HomeAD key-value pairs are ignored.
• ADList is a comma-separated list of Administrative Domain numbers to which this account is a
member. Valid numbers are between 0 to 255, inclusive. A dash between two numbers specifies a
range. Multiple ADList key-value pairs within the same or across the different Vendor-Type code are
concatenated. Multiple occurrence of the same AD number is ignored.
RADIUS authentication requires that the account have a valid role through the attribute type
Brocade-Auth-Role . The additional attribute values ADList and HomeAD are optional. If they are
unspecified, the account can login with AD0 as its member list and home Admin Domain. If there is an
error in ADList or HomeAD specification, the account cannot login until the AD list is corrected; an error
message is displayed.
For example, on a Linux FreeRadius Server, the user (user-za) with the following settings takes the
“ZoneAdmin” role, with AD member list: 1, 2, 4, 5, 6, 7, 8, 9, 12; the Home Admin Domain will be 1.
user-za Auth-Type := Local, User-Password == "password"
Brocade-Auth-Role = "ZoneAdmin",
Brocade-AVPairs1 = "ADList=1,2,6,
Brocade-AVPairs2 = "ADList=4-8;ADList=7,9,12”
In the next example, on a Linux FreeRadius Server, the user takes the “Operator” role, with ADList 0 and
homeAD 0.
user-opr Auth-Type := Local, User-Password == "password"
Brocade-Auth-Role = "operator",
Brocade-AVPairs1 = "ADList=1,2;HomeAD=2",
Brocade-AVPairs2 = "ADList=-4-8,20;ADList=7,9,12",
Setting up RADIUS AAA service
Fabric OS 3.2, 4.4.0, and later support RADIUS Authentication, Authorization, and Accounting service
(AAA). When configured for RADIUS, a switch becomes a RADIUS client. In this configuration,
authentication records are stored in the RADIUS host server database. Login and logout account name,
assigned role, and time-accounting records are also stored on the RADIUS server for each user.
By default, RADIUS service is disabled, so AAA services default to the switch local database.
To enable RADIUS service, it is strongly recommended that you access the CLI through an SSH connection
so that the shared secret is protected. Multiple login sessions can configure simultaneously, and the last
session to apply a change leaves its configuration in effect. After a configuration is applied, it persists after
a reboot or an HA failover.
The configuration is chassis-based, so it applies to all logical switches (domains) on the switch and
replicates itself on a standby CP blade, if one is present. It is saved in a configuration upload and applied
in a configuration download.
You should configure at least two RADIUS servers so that if one fails, the other will assume service. You can
set the configuration with both RADIUS service and local authentication enabled so that if all RADIUS