User role assignment using RADIUS attributes

User role assignment is configured on the RADIUS server using VSAs (vendor-specific attributes).

RADIUS servers can return multiple attribute value pairs (AVPs) in response to an authentication request. The attributes are processed in this order of precedence to determine the user role assigned:

If theAruba-Admin-RoleVSA is present, map the user to the matching local user-group name.
- Else if theAruba-Priv-Admin-UserVSA is present, extract the privilege level (1, 15, or 19) and map the user to the local user-group corresponding to this privilege level (1=operators,15=administrators,19=auditors). Privilege levels 2 to 14 may also be used with matching local user groups named 2 to 14.
  - Else If Service-Type AVP is present, mapAdministrative-User(6)toadministratorsand mapNAS-Prompt-User(7)tooperators.
    - 否则,用户角色不能be determined, and the authentication fails.

This is summarized as follows:

`Aruba-Admin-Role`	`Aruba-Priv-Admin-User`	`service-type`	User role assigned
	Do not care	Do not care	Matching local user
Not present	特权等级= 1	Do not care	Operators
Not present	特权等级= 15	Do not care	Administrators
Not present	特权等级= 19	Do not care	Auditors
Not present	privilege level =2 to 14	Do not care	Matching local user groups named 2 to 14
Not present	Not present	`Administrative-User(6)`	Administrators
Not present	Not present	`NAS-Prompt-User(7)`	Operators
Not present	Not present	Not present (or = any other value)	None (not authenticated)

NOTE:

TheService-Typeattribute is retained only for backward compatibility. It is recommended that you instead use theAruba-Admin-RoleorAruba-Priv-Admin-UserVSA.