Feature Configuration
To enable domain-based user authorization using Ops Center, use the following sample configuration:
config
tacacs-security domain-based-services [ domain-delimiter delimiter_option | domain-service domain_service_name [ group service_group_name ] | no-domain group service_group_name | nso-service-account [ group service_group_name | id service_account_id ] ]
end
NOTES:
-
domain-based-services [ domain-delimiter delimiter_option | domain-service domain_service_name [ group service_group_name ] | no-domain group service_group_name | nso-service-account [ group service_group_name | id service_account_id ] ] : Configure the required domain-based-services value. The domain-based-services includes the following options:
-
domain-delimiter : Specify the delimiter to use to determine domain. This option is mandatory and allows the following values:
-
@—If domain-delimiter is "@", the user value is in the format: <user>@<domain>.
-
/—If domain-delimiter is "/", the user value is in the format: <domain>/<user>.
-
\—If domain-delimiter is "\", the user value is in the format: <domain>\<user>.
-
-
domain-service : Specify the list of domains and their group mapping. The key is the name of the domain and group is the group that is assigned to the domain. You must configure at least one option in this list.
-
no-domain : Specify the group that has no domain or if the domain is unavailable in the domain-service mapping, then this group is sent in the accept response.
-
nso-service-account : Specify the NSO service account that has the ID and group. If you configure this parameter, then you must configure the ID and group fields. The ID and group must have string values.
-