The AAA subsystem (authentication, authorization, and accounting) is responsible for managing all supported attributes that are available to the various services within the Cisco IOS software. As such, it maintains its own local dictionary of all supported attributes. However, prior to Cisco IOS Release 12.3(14)T, most of these authorization options were not available for local (on-box) authorizations.

Effective with Cisco IOS Release 12.3(14)T, you can configure your router so that AAA authentication and authorization attributes currently available on AAA servers are made available on existing Cisco IOS devices. The attributes can be added to existing framework, such as the local user database or subscriber profile. For example, an attribute list can now be added to an existing username, providing the ability for the local user database to act as a local AAA server. For situations in which the local username list is relatively small, this flexibility allows you to provide complete user authentication or authorization locally within the Cisco IOS software without having a AAA server. This ability can allow you to maintain your user database locally or provide a failover local mechanism without having to sacrifice policy options when defining local users.

A subscriber profile allows domain-based clients to have policy applied at the end-user service level. This flexibility allows common policy to be set for all users under a domain in one place and applied there whether or not user authorization is done locally. Effective with Cisco IOS Release 12.3(14)T, an attribute list can be added to the subscriber profile, allowing the profile to apply all attributes that can be applied to services using AAA servers. Attributes that are configured under the AAA attribute list are merged with the existing attributes that are generated with the existing subscriber profile and passed to the Subscriber Server Switch (SSS) framework for application.

Note	Accounting is still done on a AAA server and is not supported by this feature.

AAA attribute lists define user profiles that are local to the router. Every attribute that is known to the AAA subsystem is made available for configuration.

The AAA attributes that are defined in the AAA attribute list are standard RADIUS or TACACS+ attributes. However, they are in the Cisco IOS internal format for that attribute. The attributes must be converted from the RADIUS format (for a RADIUS case) to the Cisco IOS AAA interface format. TACACS+ attributes are generally identical to the Cisco IOS AAA interface format.

• Converting from RADIUS Format to Cisco IOS AAA Format
  

Attributes are not validated at configuration. The AAA subsystem "knows" only the format that is expected by the services when the service defines a given attribute inside a definition file. However, it cannot validate the attribute information itself. This validation is done by a service when it first uses the attribute. This validation applies whether the AAA server is RADIUS or TACACS+. Thus, if you are not familiar with configuring a AAA server, it is advisable that you test your attribute list on a test device with the service that will be using the list before configuring and using it in a production environment.

1.    enable

2.    configure terminal

3.    aaa attribute list list-name

4.    attribute type {name} {value} [service service] [protocol protocol]

5.    attribute type {name} {value} [service service] [protocol protocol]

6.    attribute type {name} {value} [service service] [protocol protocol]

7.    attribute type {name} {value}

8.    attribute type {name} {value}

9.    attribute type {name} {value}

To define a subscriber profile, perform the following steps.

Note	RADIUS users should use the show aaa attributes command to map the RADIUS version of the particular attribute to the Cisco IOS XE AAA version of the string attribute. See the example Mapping from the RADIUS Version of a Particular Attribute to the Cisco IOS AAA Version Example.

1.    enable

2.    configure terminal

3.    subscriber authorization enable

4.    policy-map type service domain-name

5.    service local

6.    exit

7.    aaa attribute list list-name

1.    enable

2.    debug aaa authentication

3.    debug aaa authorization

4.    debug aaa per-user

5.    debug ppp authentication

6.    debug ppp error

7.    debug ppp forward

8.    debug ppp negotiation

9.    debug radius

10.    debug sss error