Authorization; Table 2: Supported Authorization Configurations - Alcatel-Lucent 7210 SAS E OS System Management Manual

Authentication, Authorization, and Accounting

Authorization

routers support local, RADIUS, and TACACS+ authorization to control the actions of specific
users by applying a profile based on user name and password configurations once network access
is granted. The profiles are configured locally as well as VSAs on the RADIUS server. See
Vendor-Specific Attributes (VSAs) on page
Once a user has been authenticated using RADIUS (or another method), the router can be
configured to perform authorization. The RADIUS server can be used to:
•
•
Profiles consist of a suite of commands that the user is allowed or not allowed to execute. When a
user issues a command, the authorization server looks at the command and the user information
and compares it with the commands in the profile. If the user is authorized to issue the command,
the command is executed. If the user is not authorized to issue the command, then the command is
not executed.
Profiles must be created on each router and should be identical for consistent results. If the profile
is not present, then access is denied.
Table 2
•
•
When authorization is configured and profiles are downloaded to the router from the RADIUS
server, the profiles are considered temporary configurations and are not saved when the user
session terminates.

Table 2: Supported Authorization Configurations

configured user
RADIUS server configured user
TACACS+ server configured user
When using authorization, maintaining a user database on the router is not required. User names
can be configured on the RADIUS server. User names are temporary and are not saved in the
Page 22
Download the user profile to the router
Send the profile name that the node should apply to the router.
displays the following scenarios:
Remote (RADIUS) authorization cannot be performed if authentication is done locally (on
the router).
The reverse scenario is supported if RADIUS authentication is successful and no
authorization is configured for the user on the RADIUS server, then local (router)
authorization is attempted, if configured in the authorization order.
28.
RADIUS Supplied Profile
Supported Not Supported
Supported Supported
Supported Not Supported
7210 SAS-E OS System Management Guide