HP AA979A - StorageWorks SAN Switch 2/8V, Administrator'S Manual, Page: 72 / 465

74 Managing user accounts
Managing Fabric OS users on the RADIUS server
All existing Fabric OS mechanisms for managing switch-local user accounts and passwords remain
functional when the switch is configured to use RADIUS. Changes made to the switch-local database do
not propagate to the RADIUS server, nor do the changes affect any account on the RADIUS server.
Switch to RADIUS server interaction
When configured to use RADIUS, the switch acts as a Network Access Server (NAS) and RADIUS client.
The switch sends all AAA service requests to the RADIUS server, following the RFC 2865 protocol. The
RADIUS server receives the request packet, validates the request and sends responses packet back to the
switch.
A switch can be configured to try both RADIUS and local switch authentication.
For chassis-based systems such as the 4/256 SAN Director, the switch IP addresses are aliases of the
physical Ethernet interfaces on the CP blades. When specifying client IP addresses for the logical switches
in such systems, make sure the CP IP addresses are used. For accessing both the active and standby CP,
and for the purpose of HA failover, both CP IP addresses of a chassis should be included in the RADIUS
server configuration.
Creating Fabric OS user accounts
With RADIUS servers, set up user accounts by their true network wide identity rather than by the account
names created on a Fabric OS switch. Along with each account name, assign appropriate switch access
roles.
RADIUS supports all the defined RBAC roles described in
Table 9 on page 61.
Users must enter their assigned RADIUS account name and password when logging in to a switch that has
been configured with RADIUS. After the RADIUS server authenticates a user, it responds with the assigned
switch role in a
Vendor-Specific Attribute
(VSA). If the response does not have a VSA role assignment, the
“user” role is assigned. If no Administrative Domain is assigned then they are assigned to the default
Admin Domain AD0.
The syntax used for assigning VSA-based account switch roles on a RADIUS server is described in
Table 14 .
Table 14 Syntax for VSA-based account roles
Item Value Description
Type 26 1 octet
Length 7 or higher 1 octet, calculated by the server
Vendor ID 1588 4 octet, Brocade's SMI Private Enterprise Code
Vendor type 1 1 octet, Brocade-Auth-Role; valid attributes for the
Brocade-Auth-Role are:
SwitchAdmin
ZoneAdmin
FabricAdmin
BasicSwitchAdmin
Operator
User
Admin
2 Optional: Specifies the Admin Domain member list. See
” RADIUS configuration and admin domains” on page 76 .
Brocade-AVPairs1
3 Brocade-AVPairs2
4 Brocade-AVPairs3
5 AVPairs4