Troubleshooting Rbac; Local Users Have More Access Permissions Than Intended; Login Attempts By Radius Users Always Fail - HPE FlexFabric 5940 Series Configuration Manual

User privilege role is network-admin, and only those commands that authorized to the
role can be used.
# If the ACS server does not respond, enter local authentication password abcdef654321 at the
prompt.
Invalid configuration or no response from the authentication server.
Change authentication mode to local.
Password:
User privilege role is network-admin, and only those commands that authorized to the
role can be used.
The output shows that you have obtained the network-admin user role.

Troubleshooting RBAC

This section describes several typical RBAC issues and their solutions.

Local users have more access permissions than intended

Symptom
A local user can use more commands than should be permitted by the assigned user roles.
Analysis
The local user might have been assigned to user roles without your knowledge. For example, the
local user is automatically assigned the default user role when you create the user.
Solution
To resolve the issue:
Use the display local-user command to examine the local user accounts for undesirable user
1.
roles, and remove them.
If the issue persists, contact Hewlett Packard Enterprise Support.
2.

Login attempts by RADIUS users always fail

Symptom
Attempts by a RADIUS user to log in to the network access device always fail, even though the
following conditions exist:
•
The network access device and the RADIUS server can communicate with one another.
•
All AAA settings are correct.
Analysis
RBAC requires that a login user have a minimum of one user role. If the RADIUS server does not
authorize the login user to use any user role, the user cannot log in to the device.
Solution
To resolve the issue:
Use one of the following methods:
1.
Configure the role default-role enable command. A RADIUS user can log in with the
default user role when no user role is assigned by the RADIUS server.
Add the user role authorization attributes on the RADIUS server.
If the issue persists, contact Hewlett Packard Enterprise Support.
2.
41