 |
» |
|
|
 |
The user information that determines how an access request
is authenticated and authorized is configured in a profile as a
set of A-V pairs. These user profiles are grouped by realm and may
be stored in flat text files or an external source such as an Oracle
database or and LDAP server. Realms are recognized by the realm
component of a user's Network Access Identifier. If you
have a small AAA deployment without several realm-specific configurations,
you can define a default realm and store it in the users file. Storing
User Profiles in the Default Users File |  |
When the AAA server receives a request, before it checks for
profiles grouped by realms, it first checks the default users file
for a matching profile. Use the following steps to store user profiles
in the default users file: Access the Server
Manager. Load the configuration from the
appropriate AAA server by selecting the Load Configuration link from the Navigation Tree. Select the Users link from the
Navigation Tree. Select the New User link. The User Attributes screen will
appear. In the User Name text box, enter the name of the user profile. In the Password text box, enter
the value to match to the value to compare to the Password attribute
value in the request. You may enter values in the remaining
fields to control the users session. These fields are optional and
correspond to RADIUS A-V pairs that are explained in more detail
in the HP-UX AAA Server Administration
and Authentication Guide. Select the Create button. Select Save Configuration from the Navigation Frame. If you have multiple
remote servers, you will prompted to select and confirm which servers
you wish to add the access device entry to.
 |  |  |  |  | CAUTION: Save Configuration will save the entire server configuration
(access devices, proxies, local realms, users, and server properties)
to the servers you specify. |  |  |  |  |
Storing
Wireless User Profiles Locally |  |
If you want to authenticate users with EAP, you will need
to identify the wireless access point (WAP), the users' realms,
and the user profiles. For more information about EAP, refer to
the HP-UX AAA Server Administration and Authentication Guide. Use
the following steps to store wireless user profiles locally: Select the
Access Devices link Select the New access device
link from the Access Device screen. The Access Device Attributes
screen appears. In the Name field identify the
IP address or DNS name of the WAP. In the Shared secret field identify
the encryption key, or shared secret, between the WAP and the AAA
server. From the Vendor drop-down list,
select Generic or the WAP vendor if the vendor appears in the vendors
file. Select any of the Options check
boxes to define additional instructions to handle the Access-Request. Select the Create button. For each individual user that
will be authenticated through EAP, you will need to add a user profile
to the RADIUS server. Select the Users link. Select the New User link from
the Users screen. The Users Attributes screen appears. In the User Name field identify
the user profile by user name and the users realm (user@realm). From the Authentication Type
drop-down list, select Realm. Complete any of the remaining
optional fields as necessary for your configuration. Select the Create button. Repeat steps 8 to 13 for each
user profile that you need to configure. For each realm using EAP, you
must associate the realm name with the type of EAP to perform. Select
the Local Realms link. Select the New local realm link
from the Local Realms screen. The Local Realm Attributes screen
appears. In the Name field identify the
name of the realm that will use EAP. From the Authentication Type
drop-down list, select EAP as the authentication type. The extended
parameters for EAP will appear From Extended Parameters select
the EAP type(s) to use. Complete any of the remaining
optional fields as necessary for your configuration. Select the Create button. Repeat steps 15 to 21 as necessary
for your configuration. Select the Save Configuration link from the Navigation Frame. If you have multiple
remote servers, you will prompted to select and confirm which servers
you wish to add the access device entry to.
 |  |  |  |  | CAUTION: Save Configuration will save the entire server configuration (access devices,
proxies, local realms, users, and server properties) to the servers you
specify. |  |  |  |  |
Grouping
Users by Realm |  |
While the HP-UX AAA Server can authenticate an individual
user, you may want to authenticate and provision a group of users
according to a common criteria, like an authentication type. One
method of grouping users is according to the realm that they belong
to. A realm is derived from a user's Network Access Identifier,
for example: name@sample.com where sample.com is the realm. Use the following steps to store
user profiles in a flat text file grouped by realm: Access Server Manager. Select the Local Realms link
from the Navigation Tree and then select the New local realm link In the Name field, enter the
users realm. From the Authentication Type
drop-down list, select File. In the DNS or filename text box,
enter a name for the file that will store the profiles. If the file
does not already exist, it will automatically be created when you
save the realm definition.  |  |  |  |  | NOTE: You can configure different realms to save users
profiles in the same file. |  |  |  |  |
Select the Create button. Return to the Local Realms screen
to add user profiles to the realm. From the Local Realms screen,
select the following icon for the realm that you wish to add user
profiles for: From the Users screen select
the New User link. In the User Name text box, enter
the name of the users profile. In the Password text box, enter
the value to match to the value to compare to the Password attribute
value in the request. You may enter values in the remaining
fields to control the users session. These fields are optional and
correspond to RADIUS A-V pairs that are explained in more detail
in the "A-V Pairs" chapter of HP-UX AAA Server Administration and Authentication
Guide. Select the Create button in the
User Attributes screen. Repeat steps 9 to 13 for each
user profile you wish to add to the realm. Repeat these steps to add additional
realms and groups of users. Select Save Configuration from the Navigation Frame. If you have multiple
remote servers, you will prompted to select and confirm which servers
you wish to add the access device entry to.
 |  |  |  |  | CAUTION: Save Configuration will save the entire server configuration
(access devices, proxies, local realms, users, and server properties)
to the servers you specify. |  |  |  |  |
|