HP SN3000B User Manual

100 Fabric OS Administrator’s Guide
53-1002446-01
The authentication model using RADIUS and LDAP
5
syntax error in the attributes, the password expiration warning will not be issued. If your RADIUS
server maintains its own password expiration attributes, you must set the exact date twice to use
this feature, once on your RADIUS server and once in the VSA attribute. If the dates do not match,
then the RADIUS server authentication fails.
The syntax used for assigning VSA-based account switch roles on a RADIUS server is described in
Table 16.
Fabric OS users on the RADIUS server
All existing Fabric OS mechanisms for managing local switch user accounts and passwords remain
functional when the switch is configured to use RADIUS. Changes made to the local switch
database do not propagate to the RADIUS server, nor do the changes affect any account on the
RADIUS server.
Windows 2000 IAS
To configure a Windows 2000 internet authentication service (IAS) server to use VSA to pass the
Admin role to the switch in the dial-in profile, the configuration specifies the Vendor code (1588),
Vendor-assigned attribute number (1), and attribute value (admin), as shown in Figure 10.
TABLE 16 Syntax for VSA-based account roles
Item Value Description
Type 26 1 octet
Length 7 or higher 1 octet, calculated by the server
Vendor ID 1588 4 octet, Brocade SMI Private Enterprise Code
Vendor type 1 1 octet, Brocade-Auth-Role; valid attributes for the Brocade-Auth-Role are:
Admin
BasicSwitchAdmin
FabricAdmin
Operator
SecurityAdmin
SwitchAdmin
User
ZoneAdmin
2 Optional: Specifies the Admin Domain or Virtual Fabric member list. For
more information on Admin Domains or Virtual Fabrics, see “RADIUS
configuration with Admin Domains or Virtual Fabrics” on page 102.
Brocade-AVPairs1
3Brocade-AVPairs2
4Brocade-AVPairs3
5Brocade-AVPairs4
6Brocade Password ExpiryDate
7Brocade Password ExpiryWarning
Vendor length 2 or higher 1 octet, calculated by server, including vendor-type and vendor-length
Attribute-specific data ASCII string Multiple octet, maximum 253, indicating the name of the assigned role and
other supported attribute values such as Admin Domain member list.

HP SN3000B Specifications

General

Brand	HP
Model	SN3000B
Category	Switch
Language	English