AAA Configuration

Choose which authentication sources are used, and in which order

The device can authenticate users against its local user database and against RADIUS, TACACS+ and LDAP servers. This configuration lists all four sources in priority order and sets each one to enable, restrict or disable. The servers themselves are configured on the RADIUS, TACACS+ and LDAP pages.

API

• Data (AUTH_CONFIG object):

  [
      {
          "source": "local",
          "setting": "enable"
      },
      {
          "source": "radius",
          "setting": "enable"
      },
      {
          "source": "tacacs",
          "setting": "enable"
      },
      {
          "source": "ldap",
          "setting": "enable"
      }
  ]

  • The order of the entries defines the priority: on login the sources are tried from first to last, and the first one that accepts the credentials wins.
  • All four sources must be present exactly once. The example above is the factory default.
  • Possible values of source:
    • local - credentials are checked against the local user database; cannot be disable-d
    • radius - RADIUS servers
    • tacacs - TACACS+ servers
    • ldap - LDAP servers
  • Possible values of setting:
    • enable - the source is tried
    • restrict - the source is tried only if every earlier source was unreachable. If the first entry is restrict, it is treated as enable. A source that rejected the credentials counts as reachable, so later restrict sources are skipped.
    • disable - the source is never tried
  • Notes: a source that has no servers configured counts as unreachable. An external source placed before local therefore adds its connection timeout to every login, including logins of local users.

• Get the current authentication configuration

  • Path: /api/aaa/config
  • Method: GET
  • Minimum user role: viewer
  • Response on success (200 OK): AUTH_CONFIG object in data

• Update the authentication configuration

  • Path: /api/aaa/config
  • Method: PUT
  • Minimum user role: admin
  • Request body: AUTH_CONFIG object (the complete list)
  • Response on success (200 OK): message Successfully updated the entry., the stored AUTH_CONFIG in data
  • Response on failure (400 Bad Request): message starts with authentication configuration: all entries must be specified and none is repeated: followed by the reason, for example local type cannot be disabled or either not all types are specified, or there are duplicates
  • Notes: the change takes effect immediately and is kept across restarts.

Back to Index