TACACS role/DAP assignment

Hi Milan,

Thanks for your post. Unfortunately, we don’t support multiple attribute/value pairs. I submitted a case for our PM team for researching.  Sorry for the inconvenience.

Hi Gerry,

thanks for your quick reply.

Another question:

I can see a warning on the bottom of DAP configuration screen:

“After modifying the privileges of an external user account, contact your system administrator to lock the account's privileges to prevent them from being restored to authentication settings.”

I don’t understand this warning.

I want NetBrain to check the user TACACS attributes EVERY time of the user login.

And if the TACACS attributes were changed (like the user is assigned to a different role by TACACS), the user privileges should also be changed in NetBrain!

That’s the basic function of TACACS authorization, isn’t it?

So the user accounts should NOT be locked with an exception of system admins, I guess?

Thanks,

Milan

Milan, 

When authenticating TACACS+ user logs in, the NetBrain system checks the attribute name and value of their roles in the TACACS+ server and assigns the corresponding roles and privileges to the IE system to them again. It will overwrites the Device Access Policy privilege if the account is not locked.