Cisco IOS XR Configuration Manual page 192

Information About Configuring AAA Services
For example, to give a user named user1 BGP read, write, and execute permissions and include user1 in
a user group named operator, the username entry in the external server's TACACS+ configuration file
would look similar to the following:
user = user1{
member = some-tac-server-group
opap = cleartext "lab"
service = exec {
}
}
The r,w,x, and d correspond to read, write, execute and debug, respectively, and the pound sign (#)
indicates that a user group follows.
The optional keyword must be added in front of "task" to enable interoperability with systems based on
Note
Cisco IOS software.
If CiscoSecure ACS is used, perform the following procedure to specify the task ID and user groups:
Enter your username and password.
Step 1
Click the Group Setup button to display the Group Setup window.
Step 2
Select the group that you want to update from the Group drop-down list.
Step 3
Click the Edit Settings button to display the Group Settings window.
Step 4
Use the scroll arrow to locate the Shell (exec) check box.
Step 5
Check the Shell (exec) check box to enable the custom attributes configuration.
Step 6
Check the Custom attributes check box.
Step 7
Enter the following task string without any blank spaces or quotation marks in the field:
Step 8
task=rwx:bgp,#netadmin
Click the Submit + Restart button to restart the server.
Step 9
The following RADIUS Vendor-Specific Attribute (VSA) example shows that the user is part of the
sysadmin predefined task group, can configure BGP, and can view the configuration for OSPF:
user Auth-Type := Local, User-Password == lab
After user1 successfully connects and logs in to the external TACACS+ server with username user1 and
appropriate password, the show user tasks command can be used in EXEC mode to display all the tasks
user1 can perform. For example:
Username:user1
Password:
RP/0/RP0/CPU0:router# show user tasks
Task:
Task:
Task:
Task:
Cisco IOS XR System Security Configuration Guide
SC-180
task = "rwx:bgp,#operator"
Service-Type = NAS-Prompt-User,
Reply-Message = "Hello, %u",
Login-Service = Telnet,
Cisco-AVPair = "shell:tasks=#sysadmin,rwx:bgp,r:ospf"
basic-services :READ
bgp :READ
cdp :READ
diag :READ
Configuring AAA Services on Cisco IOS XR Software
WRITE EXECUTEDEBUG
WRITE EXECUTE