How it Works
To support this feature configuration in Ops Center, the domain-based-services configuration is added in the TACACS security configuration. The TACACS flow change works in the following way:
-
If you have configured the domain-based-services parameter, then the configured user name that is sent to the TACACS process, splits user ID into user ID and domain. The split character, which is a domain delimiter, is configured in domain-based-services. These split characters can be "@", "/", or "\" and are used in the following format to get the domain and user ID information.
-
@ — <user id>@<domain>
-
/ — <domain>/<user id>
-
\ — <domain>\<user id>
-
-
The TACACS authenticates and authorizes as per the existing flow. However, if the domain-based-services feature is enabled and TACACS authenticates and authorizes the user, following steps are added to the TACACS flow procedure.
-
If Network Services Orchestrator (NSO) logs in as the NSO service account, then that session receives a specific NACM group that you configured in domain-based-services nso-service-account group group-name . This functionally is the same as the way NSO works.
-
If the specified domain exists in the group mapping, then the NACM group that you configured in domain-based-services domain-service domain group group-name is applied.
-
If the user does not have a domain or the domain does not exist in the domain to group mapping, then no-domain NACM group that you configured in domain-based-services no-domain group group-name is applied. If the no-domain configuration does not exist, then the user value is rejected.
-
To enable this feature, you must configure the domain-based-services CLI command with the following options:
-
NSO service account
-
Domain service
-
Domain delimiter
-
No domain