Hey John, thanks for the reply. That's a good suggestion that I'll tuck away for future reference. <div><br></div><div>I actually tracked down access to the Brocade support knowledge base and found a document someone had posted using Cisco ASA.<div>
<br></div><div>And it is:</div><div><br></div><div>brcd-role = <role></div><div><br></div><div>So my group config would be:</div><div><br></div><div><div>group = admin {</div><div> default service = permit</div><div>
service = exec {</div><div> priv-lvl = 15</div><div> brcd-role = admin</div><div> } </div><div>}</div></div><div><br></div><div>However, sharing that with Cisco devices causes them to be unhappy and fail authorization. I tried prepending the "optional" keyword e.g. "optional brcd-role = admin", which makes Cisco devices happy again, but breaks it on the Brocade.</div>
<div><br></div><div>So... almost there, but still missing something.</div><div><br><div class="gmail_quote">On Fri, Sep 30, 2011 at 1:59 PM, john heasley <span dir="ltr"><<a href="mailto:heas@shrubbery.net">heas@shrubbery.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">Fri, Sep 30, 2011 at 01:39:32PM -0700, Jathan McCollum:<br>
<div class="im">> The documentation indicates the device is expecting the server to send an<br>
> a/v pair that specifies the authenticated user's role. I assume the value<br>
> would be "admin" in this case. The problem is that nowhere in the<br>
> documentation so far have I seen what attribute the device is expecting.<br>
> There may also be a unique service type (again similar to JUNOS'<br>
> "junos-exec") that is being expected.<br>
><br>
> So... After all that background, anyone had experience with this platform<br>
> and gotten it working successfully w/ tac_plus?<br>
<br>
</div>none, but some devices send the av pairs they have when they perform<br>
authen and/or author. if you enable the appropriate debugging knobs, it<br>
might reveal it to you.<br>
<br>
or, take the image that you load on the box, uncompress it, unzip it or<br>
whatever their packaging method is, then run strings(1) on it and look<br>
for strings that might be related to authorization. then send a bomb to<br>
brocade offices.<br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>Jathan.<br>--<br>
</div></div>