Solved: Adding a user role for SAN switches

edward.gillston · ‎08-23-2007

I am trying to find the correct location in ACS 3.3 to add the following: roles="network-admin". We have our SAN switches using Tacacs+. When a user other than admin logins, you get the role as "network-operator". This doc Cisco MDS 9000 Family Troubleshooting Guide, Release 3.x explains the role if you are using IOS/PIX Radius. Thank you.

Jagdeep Gambhir · ‎08-23-2007

Hi Ed,

Here is the link,

http://www.cisco.com/en/US/docs/storage/san_switches/mds9000/sw/rel_2_x/san-os/configuration/guide/cradtac.html

If you search for:

TACACS+ custom attributes can be defined on an Access Control Server (ACS) for various

services (for example, shell). Cisco MDS 9000 Family switches require the TACACS+ custom

attribute for the service shell to be used for defining roles.

Cisco ACS TACACS+

shell:roles="network-admin"

shell:roles*"network-admin"

cisco-av-pair*shell:roles="network-admin"

cisco-av-pair*shell:roles*"network-admin"

cisco-av-pair=shell:roles*"network-admin"

On the ACS, if you go to: Interface configuration, TACACS+ (Cisco IOS), place a check nex to: " Display a window for each service selected in which you can enter customized TACACS+ attributes".

Then go into Group Setup and define the role information according to the above attributes.

Hope that helps

Regards,

~JG

View solution in original post

Jagdeep Gambhir · ‎08-23-2007