<div dir="ltr">I don't want to get distracted from my actual problem, but after reading this: <div><a href="https://shrubbery.net/pipermail/tac_plus/2012-January/001048.html">https://shrubbery.net/pipermail/tac_plus/2012-January/001048.html</a> </div><div>I thought the optional AVPs are not sent unless requested. Either way, I'm trying to figure out why <cisco-av-pair:shell:roles= "network-admin"> works but <optional shell:roles = "network-admin"> does not work. </div><div><br></div><div>Thanks.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jun 22, 2021 at 4:19 PM heasley <<a href="mailto:heas@shrubbery.net">heas@shrubbery.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">Tue, Jun 22, 2021 at 03:26:20PM -0400, Munroe Sollog:<br>
> I thought optional pairs are only sent to the device if they are requested.<br>
<br>
they should always be sent. It is the device's choice whether to<br>
act upon optional AVPs. The device MUST act upon non-optional AVPs;<br>
this is why an AVP that is unknown to a device often causes an error<br>
on/from the device.<br>
<br>
You might find an external authorization script useful for debugging<br>
or even for more flexibility in AVP manipulation.<br>
<br>
user = auth1 {<br>
before authorization "/path/pre_authorize $user $port $address"<br>
after authorization "/path/post_authorize $user $port $status"<br>
}<br>
<br>
> On Tue, Jun 22, 2021 at 3:23 PM heasley <<a href="mailto:heas@shrubbery.net" target="_blank">heas@shrubbery.net</a>> wrote:<br>
> <br>
> > Tue, Jun 22, 2021 at 01:01:37PM -0400, Munroe Sollog:<br>
> > > According to the Cisco documentation, DCNM expects the role of<br>
> > > 'network-admin' to be supplied to grant a user administrator<br>
> > privileges. I<br>
> > > was able to provide that role using this config:<br>
> > ><br>
> > > service = exec {<br>
> > ><br>
> > > priv-lvl = 15<br>
> > ><br>
> > > cisco-av-pair:shell:roles= "network-admin"<br>
> > ><br>
> > > #optional shell:roles = "network-admin"<br>
> > ><br>
> > ><br>
> > > }<br>
> > ><br>
> > > However, this causes my switches to balk. I'm trying to convert that to<br>
> > an<br>
> > > "optional" parameter as you can see in the commented line. However I am<br>
> > > not having any success. I have been trying to confirm that DCNM is<br>
> > > actually requesting the role attribute, but none of my debug commands or<br>
> > > packet captures seem to make that clear. Here is some debug output of<br>
> > both<br>
> > > the authentication and authorization phase. Any help would be<br>
> > > appreciated. Thanks.<br>
> ><br>
> > There is no "request" of the attribute. The attribute is passed with<br>
> > an authorization reply.<br>
> ><br>
> > I suspect that you have some other configuration error.<br>
> ><br>
> > > root@rover:/etc/tacacs+# /usr/sbin/tac_plus -C<br>
> > /etc/tacacs+/tac_plus.conf<br>
> > > -g -d24<br>
> > > Reading config<br>
> > > Version F4.0.4.27a Initialized 1<br>
> > > tac_plus server F4.0.4.27a starting<br>
> > > socket FD 4 AF 2<br>
> > > uid=0 euid=0 gid=0 egid=0 s=-178230864<br>
> > > connect from 192.168.1.248 [192.168.1.248]<br>
> > > 192.168.1.248 : fd 5 eof (connection closed)<br>
> > > Read -1 bytes from 192.168.1.248 , expecting 12<br>
> > > connect from 192.168.1.248 [192.168.1.248]<br>
> > > login query for 'mus3' port 49 from 192.168.1.248 accepted<br>
> > > connect from 192.168.1.248 [192.168.1.248]<br>
> > > Start authorization request<br>
> > > do_author: user='mus3'<br>
> > > user 'mus3' found<br>
> > > mus3 may run an unlimited number of sessions<br>
> > > exec authorization request for mus3<br>
> > > exec is explicitly permitted by line 226<br>
> > > nas:service=shell (passed thru)<br>
> > > nas:protocol=ip (passed thru)<br>
> > > nas:cmd= (passed thru)<br>
> > > nas:cisco-av-pair* svr:absent/deny -> delete cisco-av-pair* (i)<br>
> > > nas:shell:roles* svr:shell:roles*network-admin -> replace with<br>
> > > shell:roles*network-admin (h)<br>
> > > nas:absent, server:priv-lvl=15 -> add priv-lvl=15 (k)<br>
> > > replaced 2 args<br>
> > > authorization query for 'mus3' 49 from 192.168.1.248 accepted<br>
> > ><br>
> > ><br>
> > ><br>
> > > --<br>
> > > Munroe Sollog (He/Him/His)<br>
> > > Senior Network Engineer<br>
> > > <a href="mailto:munroe@lehigh.edu" target="_blank">munroe@lehigh.edu</a><br>
> > > -------------- next part --------------<br>
> > > An HTML attachment was scrubbed...<br>
> > > URL: <<br>
> > <a href="http://www.shrubbery.net/pipermail/tac_plus/attachments/20210622/4be317c5/attachment.htm" rel="noreferrer" target="_blank">http://www.shrubbery.net/pipermail/tac_plus/attachments/20210622/4be317c5/attachment.htm</a><br>
> > ><br>
> > > _______________________________________________<br>
> > > tac_plus mailing list<br>
> > > <a href="mailto:tac_plus@www.shrubbery.net" target="_blank">tac_plus@www.shrubbery.net</a><br>
> > > <a href="https://www.shrubbery.net/mailman/listinfo/tac_plus" rel="noreferrer" target="_blank">https://www.shrubbery.net/mailman/listinfo/tac_plus</a><br>
> ><br>
> -- <br>
> Munroe Sollog (He/Him/His)<br>
> Senior Network Engineer<br>
> <a href="mailto:munroe@lehigh.edu" target="_blank">munroe@lehigh.edu</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr">Munroe Sollog (He/Him/His)<div>Senior Network Engineer</div><div><a href="mailto:munroe@lehigh.edu" target="_blank">munroe@lehigh.edu</a></div></div></div>