 |
» |
|
|
 |
The
user information that determines how an access request is authenticated
and authorized is configured in a profile as a set of A-V pairs.
These user profiles are grouped by realm and may be stored in flat
text files or an external source such as an Oracle database or and
LDAP server. Realms are recognized by the realm component of a user’s
Network Access Identifier. If you have a small AAA deployment without
several realm-specific configurations, you can define a default
realm and store it in the users file. Storing
User Profiles in the Default Users File |  |
When
the AAA server receives a request, before it checks for profiles
grouped by realms, it first checks the default users file for a
matching profile. Use the following steps to store user profiles
in the default users file: Access the Server
Manager. Load the configuration from the
appropriate AAA server by selecting the Load Configuration link from the Navigation Tree. Select the Users link from the
Navigation Tree. Select the New User link. The User Attributes screen will
appear. In the User Name text box, enter the name of the user profile.  |  |  |  |  | IMPORTANT: You must enter the user’s fully-qualified
name when adding to the default users file. For example, enter user1@organization.com instead of only entering user1. |  |  |  |  |
Select Local from the Authentication
Type list to authenticate the user with the authentication method
configured for their realm. Selecting options other than Local will
supersede the authentication method configured for the user’s
realm and define a specific authentication method for that individual
user. Enter a password for the user
and confirm it by entering it again. Choose how you want to store
the user’s password by selecting a hashing method in the
Password Hashing Mechanism field. Select Plain Text to be compatible
with most client password hashing methods. If you prefer not to
use Plain Text, be sure the method you choose is compatible with
the client password hashing method. The following table lists the
supported client password hashing methods and each storage hash
you should use for each method: Table 3-1 Password
Hashing Compatibility Client Password Hash | Storage Hash |
|---|
PAP | Any | | MSCHAP | NT Hash or Plain Text | | MD5 | MD5 or Plain Text | GTC Static | Any |
You may enter values in the remaining
fields to control the users session. These fields are optional and
correspond to RADIUS A-V pairs that are explained in more detail
in the HP-UX AAA Server Administrator’s
Guide. Select the Create button. Select Save Configuration from the Navigation Frame. If you have multiple remote
servers, you will prompted to select and confirm which servers you
wish to add the access device entry to.
 |  |  |  |  | CAUTION: Save Configuration will save the entire server configuration
(access devices, proxies, local realms, users, and server properties)
to the servers you specify. |  |  |  |  |
Grouping
Users by Realm |  |
While
the HP-UX AAA Server can authenticate an individual user, you may
want to authenticate and provision a group of users according to
a common criteria, like an authentication type. One method of grouping
users is according to the realm that they belong to. A realm is
derived from a user’s Network Access Identifier, for example: name@sample.com where sample.com is the realm. Use the following steps to store
user profiles in a flat text file grouped by realm: Access Server Manager. Select the Local Realms link
from the Navigation Tree and then select the New local realm link In the Name field, enter the
realm name. Select Authentication from the
Realm Type drop-down list. Select Users File in the User
Profile Storage drop-down list. Select the Users Profile Grouped
by Realm button in the User Storage Parameters field. Identify a
file to store the user information for the realm by entering a name in
the File Name box. The AAA server adds a .users extension to the value you enter in the File Name
box. Do not enter a path or use the / character. In the Security Methods field,
choose the authentication methods to authenticate the users from
the realm. Select the Create button. Return to the Local Realms screen
to add user profiles to the realm. From the Local Realms screen,
select the following icon for the realm that you wish to add user
profiles for: From the Users screen select
the New User link. In the User Name text box, enter
the name of the users profile. In the Password text box, enter
the value to match to the value to compare to the Password attribute
value in the request. Confirm the password by entering it again. You may enter values in the remaining
fields to control the users session. These fields are optional and
correspond to RADIUS A-V pairs that are explained in more detail
in the “A-V Pairs” chapter of HP-UX AAA Server Administration and Authentication
Guide. Select the Create button in the
User Attributes screen. Repeat steps 9 to 13 for each
user profile you wish to add to the realm. Repeat these steps to add additional
realms and groups of users. Select Save Configuration from the Navigation Frame. If you have multiple remote
servers, you will prompted to select and confirm which servers you
wish to add the access device entry to.
 |  |  |  |  | CAUTION: Save Configuration will save the entire server configuration
(access devices, proxies, local realms, users, and server properties)
to the servers you specify. |  |  |  |  |
|