Citrix ByteMobile T1010, Установка, настройка и администрирование

Страница: 123 / 172

T-Series Traffic Director Installation, Configuration and Administration Guide 5-11
Authentication and Authorization
To bind a user to a group:
At the T1000 command prompt, type the following commands to bind a user account to a
group and verify the configuration:
• bind system group groupName -userName userName
• show system group groupName
For example:
> bind system group Managers -userName user1
Done
> bind system group Managers -userName johnd
Done
> show system group Managers
Group name: Managers Prompt String: Group-Managers-at-%h
User name: user1
User name: johnd
Done
> show system user user1
User name: user1 Prompt String: Group-Managers-at-%h Prompt Inherited From: Group
Group name: Managers
Done
> show system user johnd
User name: johnd Prompt String: user-%u-at-%T Prompt Inherited From: User
Group name: Managers
Done
To unbind a user from a group:
At the T1000 command prompt, enter the following commands to unbind a user account and
verify the configuration:
• unbind system group groupName -userName userName
• show system group groupName
Configuring Command Policies
Command policies regulate which commands, command groups, vservers, and other entities
that users and user groups are permitted to use. The T1000 provides a set of built-in
command policies, and you can configure custom policies. To apply the policies, you bind
them to users and/or groups.
Here are the key points to keep in mind when defining and applying command policies.
• You cannot create global command policies. Command policies must be bound
directly to T1000 users and groups.
• Users or groups with no associated command policies are subject to the default
(DENY-ALL) command policy, and are therefore unable to execute any
configuration commands until the proper command policies are bound to their
accounts.
• All users inherit the policies of the groups to which they belong.
• You must assign a priority to a command policy when you bind it to a user account or
group account. This enables the T1000 to determine which policy has priority when
two or more conflicting policies apply to the same user or group.