Radius Configuration With Admin Domains Or Virtual Fabrics; Acceptable Keys; Radius Authentication - HP A7533A - Brocade 4Gb SAN Switch Base Administrator's Manual

After you have completed the dictionary file, define the role for the user in a configuration file. For
example, to grant the user jsmith the Admin role, you would add the following statement to the
configuration file:
swladmin

RADIUS configuration with Admin Domains or Virtual Fabrics

When configuring users with Admin Domains or Virtual Fabrics, you must also include the Admin Domain
or Virtual Fabric member list. This section describes the way that you configure attribute types for this
configuration.
The values for the new attribute types use the syntax key=val[;key=val], where key is a text description of
attributes, value is the attribute value for the given key, the equal sign (=) is the separator between key and
value, and the semicolon (;) is an optional separator for multiple key-value pairs.

Acceptable keys

Multiple key-value pairs can appear for one Vendor-Type code. Key-value pairs with the same key name
may be concatenated across multiple Vendor-Type codes. You can use any combination of the Vendor-Type
codes to specify key-value pairs. Note that a switch always parses these attributes from Vendor-Type code
2 to Vendor-Type code 4.
Only four kinds of keys are accepted; all other keys are ignored. The following keys are accepted:
• HomeAD is the designated home Admin Domain for the account. The valid value is between 0 to 255,
inclusive. The first valid HomeAD key-value pair is accepted by the switch, and any additional
HomeAD key-value pairs are ignored.
• ADList is a comma-separated list of Administrative Domain numbers of which this account is a member.
Valid numbers range from 0 to 255, inclusive. A dash between two numbers specifies a range. Multiple
ADlist key-value pairs within the same or across the different Vendor-Type codes are concatenated.
Multiple occurrences of the same Admin Domain number are ignored.
• HomeContext is the designated home Virtual Fabric for the account. The valid values are between 1 to
128 and chassis context. The first valid HomeContext key-value pair is accepted by the switch,
Additional HomeContext key-value pairs are ignored.
• ContextRoleList is a comma-separated list of Virtual Fabric ID numbers of which this account is a
member. Valid numbers range from 1- 1 28, inclusive. A dash between two numbers specifies a range.
Multiple VFlist key-value pairs within the same or across the different Vendor-Type codes are
concatenated. Multiple occurrences of the same VF ID number are ignored.

RADIUS authentication

RADIUS authentication requires that the account have a valid role through the attribute type
Brocade-Auth-Role. The additional attribute values ADList, HomeAD, HomeContext, and ContextRoleList are
optional. If they are unspecified, the account can log in with AD0 as its member list and home Admin
Domain or VF128 as its member list and home Virtual Fabric. If there is an error in the ADlist, HomeAD,
VFlist, or Home Context specification, the account cannot log in until the AD list or VF list is corrected; an
error message is displayed.
For example, on a Linux FreeRadius Server, the user (user-za) with the following settings takes the
"zoneAdmin" role, with AD member list: 1, 2, 4, 5, 6, 7, 8, 9, 12; the Home Admin Domain will be 1.
user-za Auth-Type := Local, User-Password == "password"
Brocade-Auth-Role = "ZoneAdmin",
Brocade-AVPairs1 = "ADList=1,2,6,"
Brocade-AVPairs2 = "ADList=4-8;ADList=7,9,12"
Auth-Type := Local, User-Password == "myPassword"
Brocade-Auth-Role = "admin",
Brocade-AVPairs1 = "HomeLF=70",
Brocade-AVPairs2 =
"LFRoleList=admin:2,4-8,70,80,128;ChassisRole=admin",
Brocade-Passwd-ExpiryDate = "11/10/2008",
Brocade-Passwd-WarnPeriod = "30"
Fabric OS 6.2 administrator guide 87