Radius and Brocade 4Gb SAN Switch for HP c-Class BladeSystem

[Elmar Knipp]

I have successfully configured user authentication for this switch with my Radius server. I want to give these users the admin role.

When these users log in, they only have the users role. The follwing message is displayed after a login with telnet:

Switch role not specified, use default.

My radius server sents back the flag

AVP: l=6 t=Service-Type(6): Administrative-User(6)

(checked with wireshark packet sniffer) but the switch seams to ignore this.

How can I configure the admin role?

[cenk sasmaztin]

are you want configure admin role users

you must be go to active directory server and go active directort users and computers in this page you see user account.

for make change role account (user or admin)
you make double clik on user and go to member of tab and attach this user administrator group on server

cenk

[Elmar Knipp]

Cent,

many thanks for the answer.

My radius server is not an Microsoft Active Directory Server. It is a RSA SecurID system, which has a built in radius server. I have made the analog configuration as you proposed with AD. And as written in my first post, the servers answers with the flag "Administrative-User(6)" (which is defined in the RFC).

So why is the switch not using this flag?

Regards,
Elmar

[cenk sasmaztin]

hi Elmar sorry I now understand
please send me your switch show tech command print.

cenk

[Elmar Knipp]

Cent,

you are speaking of the command "configshow" of the switch? I can run also a "supportshow" but the output is 1,5 MBytes long ;-)

I have XXXXX-ed the radius secrets.

Elmar

[cenk sasmaztin]

hi Elmar
are you make speak which switch model ?

cenk

[cenk sasmaztin]

sorry Elmar you have switch hp san switch I'm Procurve expert sorry ..
I'm not you help

cenk

[Mike Celone]

Elamr I am attempting to do the same thing. Where you ever able to get this figured out?

[André Beck]

Hi Elmar,

on Cisco IOS there is a similar pitfall in that configuring authentication (aaa authentication ...) is sufficient to get a login, but in order to actually get an elevated permission profile, you have to add authorization statements as well (aaa authorization ...). But the config you posted doesn't look like anything I've ever seen before and

> auth.policy:0
> auth.policy.dev:3

doesn't even reveal which of the first two As of AAA it's talking about or how it links to the configured RADIUS servers. So I can't help much but to point into this direction: look out for additional non-obvious authorization-related config options.

HTH,
Andre.