Displaying Authorization Information - HP E3800-24G-PoE+-2SFP+ Access Security Manual

RADIUS Authentication, Authorization, and Accounting
Commands Authorization
6-38

Displaying Authorization Information

You can show the authorization information by entering this command:
Syntax: show authorization
Configures authorization for controlling access to CLI
commands. When enabled, the switch checks the list of commands
supplied by the RADIUS server during user authentication to
determine if a command entered by the user can be executed.
An example of the output is shown.
HP Switch(config)# show authorization
Status and Counters - Authorization Information
Type | Method
-------- + ------
Commands | RADIUS
Figure 6-15. Example of Show Authorization Command
Configuring Commands Authorization on a RADIUS
Server
Using Vendor Specific Attributes (VSAs)
Some RADIUS-based features implemented on HP switches use HP VSAs for
information exchange with the RADIUS server. RADIUS Access-Accept pack-
ets sent to the switch may contain the vendor-specific information. The
attributes supported with commands authorization are:
HP-Command-String: List of commands (regular expressions) that
■
are permitted (or denied) execution by the user. The commands are
delimited by semi-colons and must be between 1 and 249 characters
in length. Multiple instances of this attribute may be present in
Access-Accept packets. (A single instance may be present in
Accounting-Request packets.)
HP-Command-Exception: A flag that specifies whether the
■
commands indicated by the HP-Command-String attribute are
permitted or denied to the user. A zero (0) means permit all listed
commands and deny all others; a one (1) means deny all listed
commands and permit all others.