Outlines the authentication fallback mechanism, detailing how authentication order impacts fallback to secondary methods and describing user group assignment based on remote and local authentication outcomes.
You can configure authentication to fall back to a secondary or tertiary authentication mechanism when the higher-priority authentication method fails to authenticate a user, either because the user has entered invalid credentials or because the authentication server is unreachable (or all the servers are unreachable).
If the authentication order is configured as
-
radius local: With radius as the default authentication, local authentication is used only when all RADIUS servers are unreachable. If an authentication attempt via a RADIUS server fails, the user is not allowed to log in even if they have provided the correct credentials for local authentication.
-
local radius: With local as the default authentication, RADIUS authentication is tried when a username and matching password are not present in the running configuration on the local device.
-
radius tacacs local: With radius as the default authentication, TACACS+ is tried only when all RADIUS servers are unreachable, and local authentication is tried only when all TACACS+ servers are unreachable. If an authentication attempt via a RADIUS server fails, the user is not allowed to log in even if they have provided the correct credentials for the TACACS+ server. Similarly, if a TACACS+ server denies access, the user cannot log via local authentication.
User group assignment after authentication
After the remote server authenticates a user, it assigns the user to a user group:
-
If a remote server validates the authentication but does not specify a user group, it places the user in the basic user group.
-
If a remote server validates the authentication and specifies a user group (say, X), it assigns the user to that group only. However, if that user is also configured locally and belongs to a user group (for example, group Y), the user is assigned to both groups (X and Y).
-
If a remote server validates the authentication and the user is not configured locally, the system logs the user into the vshell as the basic user, with a home directory of /home/basic.
-
If a remote server validates the authentication and the user is configured locally, the system logs the user into the vshell under their local username (for example, "eve") with a home directory of /home/username (for example, /home/eve).