Domain-Based User Management - HP 5120 EI Switch Series Configuration Manual

The user inputs the password.
9.
After receiving the login password, the HWTACACS client sends the HWTACACS server a
10.
continue-authentication packet that carries the login password.
The HWTACACS server sends back an authentication response to indicate that the user has passed
11.
authentication.
The HWTACACS client sends the user authorization request packet to the HWTACACS server.
12.
The HWTACACS server sends back the authorization response, indicating that the user is now
13.
authorized.
Knowing that the user is now authorized, the HWTACACS client pushes its configuration interface
14.
to the user.
The HWTACACS client sends a start-accounting request to the HWTACACS server.
15.
The HWTACACS server sends back an accounting response, indicating that it has received the
16.
start-accounting request.
The user logs off.
17.
The HWTACACS client sends a stop-accounting request to the HWTACACS server.
18.
The HWTACACS server sends back a stop-accounting response, indicating that the stop-accounting
19.
request has been received.

Domain-based user management

A NAS manages users based on Internet service provider (ISP) domains. On a NAS, each user belongs
to one ISP domain. A NAS determines the ISP domain a user belongs to by the username entered by the
user at login, as shown in
Figure 7 Determine the ISP domain of a user by the username
A user enters the username in
the form of
userid@domain-name
or userid
The authentication, authorization, and accounting of a user depends on the AAA methods configured for
the domain that the user belongs to. If no specific AAA methods are configured for the domain, the
default methods are used. By default, a domain uses local authentication, local authorization, and local
accounting.
The AAA feature allows you to manage users based on their access types:
LAN users—Users on a LAN who must pass 802.1X authentication or MAC address authentication

to access the network.
 Login users—Users who want to log in to the device, including SSH users, Telnet users, FTP users,
and terminal service users.
Portal users—Users who must pass portal authentication to access the network.

Figure 7.
NAS
Username carries
@domain-name?
Use the default domain to
authenticate the user
9
Use domain domain-name
Yes
to authenticate the user
No