Dell PowerConnect W-Clearpass 100 Software Guía de usuario descargar pdf (Pagina 171)

ClearPass Guest 3.9 | Deployment Guide RADIUS Services | 171

 Use PHP code to assign a user role (Advanced) may be used to control the mapping between the

user account returned by an external authentication server and the RADIUS user role.

 The RADIUS server will return an Access-Reject message if the user authentication fails.

 If the authentication is successful, the authorization code is evaluated. The user object returned

from the external authentication server is available as the variable $user.

 The PHP code should return one of the following values:

 The ID of a user role (that is, an integer value) to assign that role to the external user.

 NULL to indicate no role (that is, authentication only).

 FALSE or a standard result type such as array('error' => 1, 'message' =>

'description of failure') to indicate an authorization failure

 Authorization of the user then continues using the specified role ID. The RADIUS server will return

an Access-Reject message if the authorization fails.

 The RADIUS server will return an Access-Accept message that includes the corresponding attributes

from the user role if the authentication and authorization steps are both successful.

Click the Save Changes button to complete the creation or modification of the external authentication

server.

About Authorization Methods in External Authentication Servers

The level of authorized access an authenticated user can have is controlled by the external authentication

server’s authorization method.

There are two aspects to user authorization:

 Is the user allowed? Yes/no decisions can be made in the context of authorization. Examples: user

account not enabled; user account expired; user account exceeded a traffic quota within a certain time

window.

 What are the user’s permitted limits? These are not yes/no decisions, but might involve a calculation

based on previous usage (for example, via the accounting-based authorization functions), or based on

properties of a user account (for example, maximum session lifetime is based on the expiration time for

the account).

Each server’s authorization method can be configured. The authorization methods available vary according

to the type of authentication server:

 No authorization — Authenticate only may be used to provide a basic user authentication service.

The RADIUS server will respond with an Access-Accept or Access-Reject for the authentication attempt.

Only RADIUS attributes directly related to user authentication will be returned; all other attributes will

be ignored.

You will be prompted to restart the RADIUS server after making configuration changes affecting external

authentication.

1 2 ... 166 167 168 169 170 171 172 173 174 175 176 ... 517 518

Sin comentarios

Dell PowerConnect W-Clearpass 100 Software Guía de usuario Pagina 171