TACACS+ Authentication Manager Help >> Operation Guide >> Device User Policy >> Authorization Policy Management

Authorization Policy Management

An authorization policy defines the shell profiles and command sets that are assigned to users in different scenarios. An authorization policy includes multiple access scenarios, and each access scenario includes one shell profile and one command set. If a device user matches several access scenarios, TAM assigns the user the shell profile and command set with the highest user privilege in that access scenario.

Features

• Add Authorization Policy
  
  Perform this task to add an authorization policy.

  Procedure

  1. Click the User tab, and select Device User Policy > Authorization Policies from the navigation tree to open the Authorization Policy List page.
  2. Click Add to open the page for adding an authorization policy.
  3. Type the policy name and description.
  4. Enable Dynamic Token. Select this option to enable TAM to work with the dynamic token for user authentication. To log on to the device, a TAM user must provide the correct user password and dynamic token password.
  5. Click Add in the Access Authorization Info area. The Access Authorization dialog box appears.
  6. Select a Devices Area, Device Type, Authorized Time Range and Endpoint IP Group. A device user can be authorized only when the device that the user logs in matches the four criteria simultaneously. If you select Unlimited for Device Area, any device area matches the criteria. If you select Unlimited for Device Type, any device type matches the criteria. If you select Unlimited for Authorized Time Range, any authorized time range matches the criteria. If you select Unlimited for Endpoint IP Group, any endpoint ip group matches the criteria. For more information about device area, device type, and authorized time range, see Device Area Management, Device Type Management, Authorized Time Range Policy Management and Endpoint IP Group.
  7. Select a Shell Profile. Deny means the device denies user login. Default Device Configuration means the user uses the default Shell Profile. For how to create a Shell Profile, see Shell Profile Configuration.
  8. Select an Authorization Command Set. Unlimited means the user can perform any command. Forbid means the user can use no command. For how to create an authorization command set, see Command Set Configuration.
  9. Click OK.
  10. Repeat steps 5 through 9 to add more authorization policies. Two authorization policies cannot have the same combination of device area, device type, and authorized time range.
  11. Click OK.
• Modify Authorization Policy
  
  Perform this task to modify an authorization policy.

  Procedure

  1. Click the User tab, and select Device User Policy > Authorization Policies from the navigation tree to open the Authorization Policy List page.
  2. Click the icon of the target authorization policy to open the page for modifying the policy.
  3. Modify parameters as needed. For more information about the parameters, see Add Authorization Policy.
  4. Click OK.
• Delete Authorization Policy
  
  Perform this task to delete an authorization policy. You cannot delete authorization policies in use.

  Procedure

  1. Click the User tab, and select Device User Policy > Authorization Policies from the navigation tree to open the Authorization Policy List page.
  2. Click the icon of the target authorization policy.
     A confirmation dialog box appears.
  3. Click OK.

Remarks

• Each authorization policy includes a default authorization item that defines a shell profile and command set assigned to a user when the user matches no other authorization items. The authorization item has the lowest priority and cannot be deleted. The user can only modify the shell profile and command set.
• When selecting a device area, select the area and all of its sub areas. When selecting a device type, select the device type and all of its sub types.