Tacacs+ Authentication Features In Lenovo N/Os; Authorization - Lenovo CN4093 Application Manual

TACACS+ Authentication Features in Lenovo N/OS

Authorization

© Copyright Lenovo 2015
Authentication is the action of determining the identity of a user, and is generally
done when the user first attempts to log in to a device or gain access to its services.
Lenovo N/OS supports ASCII inbound login to the device. PAP, CHAP and ARAP
login methods, TACACS+ change password requests, and one-time password
authentication are not supported.
Authorization is the action of determining a user's privileges on the device, and
usually takes place after authentication.
The default mapping between TACACS+ authorization levels and Lenovo N/OS
management access levels is shown in
this table must be defined on the TACACS+ server.
Table 9.
Default TACACS+ Authorization Levels
Lenovo N/OS User Access Level TACACS+ Level
user
oper
admin (USERID)
Alternate mapping between TACACS+ authorization levels and Lenovo N/OS
management access levels is shown in
the alternate TACACS+ authorization levels:
CN 4093(config)# tacacs-server privilege-mapping
Table 10.
Alternate TACACS+ Authorization Levels
Lenovo N/OS User Access Level
user
oper
admin (USERID)
You can customize the mapping between TACACS+ privilege levels and CN4093
management access levels. Use the following command to manually map each
TACACS+ privilege level (0-15) to a corresponding CN4093 management access
level: CN 4093(config)# tacacs-server user-mapping
If the remote user is successfully authenticated by the authentication server, the
switch verifies the privileges of the remote user and authorizes the appropriate
access. The administrator has an option to allow backdoor access via Telnet
(CN 4093(config)# tacacs-server backdoor). The default value for
Telnet access is disabled. The administrator also can enable secure backdoor
(CN 4093(config)# tacacs-server secure-backdoor), to allow access if
both the primary and the secondary TACACS+ servers fail to respond.
Note: To obtain the TACACS+ backdoor password for your switch, contact your
Service and Support line.
Table 9. The authorization levels listed in
0
3
6
Table 10. Use the following command to use
TACACS+ Level
0–1
6–8
14–15
Chapter 5: Authentication & Authorization Protocols
89