18
Default
The default authentication methods of the ISP domain are used for user role authentication.
Views
ISP domain view
Predefined user roles
network-admin
mdc-admin
Parameters
hwtacacs-scheme
hwtacacs-scheme-name
: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
radius-scheme
radius-scheme-name
: Specifies a RADIUS scheme by its name, a case-insensitive
string of 1 to 32 characters.
Usage guidelines
To enable a user to obtain another user role without reconnecting to the device, you must configure
user role authentication. The device supports local and remote methods for user role authentication.
For more information about user role authentication, see RBAC configuration in
Fundamentals
Configuration Guide
.
You can specify one authentication method and one backup authentication method to use in case
that the previous authentication method is invalid.
Examples
# In ISP domain
test
, perform user role authentication based on HWTACACS scheme
tac
.
<Sysname> system-view
[Sysname] super authentication-mode scheme
[Sysname] domain test
[Sysname-isp-test] authentication super hwtacacs-scheme tac
Related commands
authentication default
hwtacacs scheme
radius scheme
authorization command
Use
authorization command
to specify command authorization methods.
Use
undo authorization command
to restore the default.
Syntax
In non-FIPS mode:
authorization command
{
hwtacacs-scheme
hwtacacs-scheme-name
[
local
] [
none
] |
local
[
none
] |
none
}
undo authorization command
In FIPS mode:
authorization command
{
hwtacacs-scheme
hwtacacs-scheme-name
[
local
] |
local
}
undo authorization command
