Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 119 / 1026

There are also two kinds of authentication modes for NSM users: local mode and RADIUS
mode. Both User and Domain can define these modes and Domain’s authentication
mode is applied to all the users within it. User’s Authentication mode has a higher priority
and can override Domain’s mode.
The NSM user is authenticated based on the rules listed in Table 15 on page 69.
Table 15: How to Authenticate Users
Authorization Authentication Results
Domain
Auth
Mode User
Auth
Mode User in
Local
Database
Rule
Local Authenticates user locally. Local Local Defined 1
Local Authenticates user locally
first. If fails, RADIUS
authentication is used. Remote Local Defined 2
Local Authenticates user remotely. Local Remote Defined 3
Local Authenticates user remotely. Remote Remote Defined 4
Remote Authenticates user remotely. Local — Not Defined 5
Remote Authenticates user remotely. Remote — Not Defined 6
Dictionary File
To authenticate local or remote users from a RADIUS server, you must first define role
mapping assignments and domain names in NSM. If you use Steel Belted RADIUS, you
can copy the NSM RADIUS dictionary to your RADIUS server.
This file ( netscreen.dct ) is available in the NSM. If you installed NSM using the default
options, you can find the dictionary in the following location:
/usr/netscreen/GuiSvr/utils/netscreen.dct
RADIUS VSA Definition
RADIUS vendor specific attribute (VSA) is available to allow vendors to support their
own extended attributes. If you use a RADIUS server other than Steel-Belted RADIUS,
you must enter the following NSM attributes in your RADIUS dictionary file.
These attributes are case sensitive and must be entered exactly as they appear below:
ATTRIBUTE NS-NSM-User-Domain-Name 26 [vid=3224 type1=220 len1=+2 data=string]
ATTRIBUTE NS-NSM-User-Role-Mapping 26 [vid=3224 type1=221 len1=+2 data=string]
When a user is defined only in RADIUS, you must define NS-NSM-User-Domain- Name
and role mapping assignment. Auth Handler checks if the domain name matches the
user’s login domain name when NSM authenticates the user. Role mapping lists are used
for NSM access control purposes.
69 Copyright © 2010, Juniper Networks, Inc.
Chapter 3: Configuring Role-Based Administration