Table 15: How To Authenticate Users - Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Administration Manual

Copyright © 2010, Juniper Networks, Inc.
There are also two kinds of authentication modes for NSM users: local mode and RADIUS
mode. Both User and Domain can define these modes and Domain's authentication
mode is applied to all the users within it. User's Authentication mode has a higher priority
and can override Domain's mode.
The NSM user is authenticated based on the rules listed in Table 15 on page 69.

Table 15: How to Authenticate Users

User in User
Local Auth
Rule Database Mode
1 Defined Local
2 Defined Local
3 Defined Remote
4 Defined Remote
5 Not Defined —
6 Not Defined —
Dictionary File
To authenticate local or remote users from a RADIUS server, you must first define role
mapping assignments and domain names in NSM. If you use Steel Belted RADIUS, you
can copy the NSM RADIUS dictionary to your RADIUS server.
This file ( netscreen.dct ) is available in the NSM. If you installed NSM using the default
options, you can find the dictionary in the following location:
/usr/netscreen/GuiSvr/utils/netscreen.dct
RADIUS VSA Definition
RADIUS vendor specific attribute (VSA) is available to allow vendors to support their
own extended attributes. If you use a RADIUS server other than Steel-Belted RADIUS,
you must enter the following NSM attributes in your RADIUS dictionary file.
These attributes are case sensitive and must be entered exactly as they appear below:
ATTRIBUTE NS-NSM-User-Domain-Name 26 [vid=3224 type1=220 len1=+2 data=string]
ATTRIBUTE NS-NSM-User-Role-Mapping 26 [vid=3224 type1=221 len1=+2 data=string]
When a user is defined only in RADIUS, you must define NS-NSM-User-Domain- Name
and role mapping assignment. Auth Handler checks if the domain name matches the
user's login domain name when NSM authenticates the user. Role mapping lists are used
for NSM access control purposes.
Chapter 3: Configuring Role-Based Administration
Domain
Auth
Mode Authentication Results
Local Authenticates user locally.
Remote Authenticates user locally
first. If fails, RADIUS
authentication is used.
Local Authenticates user remotely.
Remote Authenticates user remotely.
Local Authenticates user remotely.
Remote Authenticates user remotely.
Authorization
Local
Local
Local
Local
Remote
Remote
69