Juniper NETWORK AND SECURITY MANAGER 2010.2 - ADMINISTRATION GUIDE REV1 Administration Manual page 119

Copyright © 2010, Juniper Networks, Inc.
Table 15: How to Authenticate Users (continued)
User in User
Local Auth
Rule Database Mode
2 Defined Local
3 Defined Remote
4 Defined Remote
5 Not Defined —
6 Not Defined —
Dictionary File
To authenticate local or remote users from a RADIUS server, you must first define role
mapping assignments and domain names in NSM. If you use Steel Belted RADIUS, you
can copy the NSM RADIUS dictionary to your RADIUS server.
This file ( ) is available in the NSM. If you installed NSM using the default
netscreen.dct
options, you can find the dictionary in the following location:
/usr/netscreen/GuiSvr/utils/netscreen.dct
RADIUS VSA Definition
RADIUS vendor specific attribute (VSA) is available to allow vendors to support their
own extended attributes. If you use a RADIUS server other than Steel-Belted RADIUS,
you must enter the following NSM attributes in your RADIUS dictionary file.
These attributes are case sensitive and must be entered exactly as they appear below:
ATTRIBUTE NS-NSM-User-Domain-Name 26 [vid=3224 type1=220 len1=+2 data=string]
ATTRIBUTE NS-NSM-User-Role-Mapping 26 [vid=3224 type1=221 len1=+2 data=string]
When a user is defined only in RADIUS, you must define NS-NSM-User-Domain- Name
and role mapping assignment. Auth Handler checks if the domain name matches the
user's login domain name when NSM authenticates the user. Role mapping lists are used
for NSM access control purposes.
Custom Roles
Figure 14 on page 70 shows the format for a custom role. The format for the custom role
of NS-NSM-User-Role-Mapping is:
domainName1:domainName2.roleName
domainName1 is the domain that the current user can access.
is the domain that the current role (
domainName2
Chapter 3: Configuring Role-Based Administration
Domain
Auth
Mode Authentication Results
Remote Authenticates user locally
first. If fails, RADIUS
authentication is used.
Local Authenticates user remotely.
Remote Authenticates user remotely.
Local Authenticates user remotely.
Remote Authenticates user remotely.
roleName
Authorization
Local
Local
Local
Remote
Remote
) belongs to.
69