TACACS+ Authentication Manager Help >> Operation Guide >> Device User >> Device User Management

Device User Management

This feature is used by a device user to log in to and manage device user accounts.

Features

• Query Device Users
  
  Perform this task to query device users by predefined query criteria.

  Procedure

  1. Click the User tab, and then select Device User > All Device Users from the navigation tree. The device user list displays all normal-status device users that all operators can view.
  2. The Query Device Users function provides the basic query and advanced query. You can switch between basic query and advanced query by clicking the Basic Query link and the Advanced Query link in the right upper corner. Set the basic or advanced query criteria and click Query. The basic query criteria include the account name and device user group. The advanced query criteria include the account name, user name, device user group, status, Max. online users, creation time, last logoff time, expiration date, LDAP synchronization policy, LDAP user status, privilege-increase password, password application, and password expiration date. Account name and user name support fuzzy query.
  3. Click Query to display the device users matching the query criteria or click Reset to query device users with the default query criteria.
• Add a Device User
  
  Perform this task to add a device user.

  Procedure

  1. Click the User tab, and then select Device User > All Device Users from the navigation tree.
  2. Click Add.
  3. Enter a unique account name for the device user. The account will be authenticated when the user logs in to the device.
  4. Enter the user name. The user name is the real name of the device manager.
  5. Enter the login password and confirm the password.
  6. Select a device user group for the device user. After the device user is added to the group, the device user automatically inherits the authorization policy of the group.
  7. Select an authorization policy for the device user, or keep this parameter blank. If you do not select a user authorization policy, the user uses the authorization policy of its device user group. If you select a user authorization policy, the selected policy takes precedence over the device user group's authorization policy.
  8. Enter the max. online users. This value specifies the maximum number of users that can use this device user account to manage a device at the same time. Leaving this parameter blank means to not limit the number of online users.
  9. Select an expiration date. The device user cannot be used from the current day of the expiration date. If you do not select an expiration date for the device user, the device user never expires.
  10. Select Enable Privilege-Increase Password. Specify a privilege-increase password and set an expiration date for it. After logging in to a device, the device user can use the password to elevate the user privilege to the highest level. An empty password expiration date indicates that the privilege-increase password never expires.
  11. Highest Privilege Level. Set the highest level to which the privilege level can be increased. The privilege increase request is denied if the highest level is exceeded. This option is available when Enable Password Strategy is selected.
  12. Select Modify Password at Next Login.Determine whether to select the Modify Password at Next Login option. If this option is selected, the device user must modify the password at the next login. This option is available when Enable Privilege-Increase Password is selected.
  13. Enables or disables the user password control strategy. The strategy controls the minimum password length, mandatory characters, and other restrictions when a device user changes the password. An INC administrator can change the login password of any device user regardless of whether or not the strategy is enabled.
  14. Configure an authorized user IP address list. This list contains IP addresses of users that are authorized to log in to the device. During user authentication and authorization, the device searches for the IP address of the user in the list to determine whether the IP address is an authorized one.
  15. Click OK.
• Batch Import Device Users
  
  Perform this task to import device users from a file.

  Procedure

  1. Click the User tab, and then select Device User > All Device Users from the navigation tree.
  2. Click Batch Import.
  3. Select the file to be uploaded, select the column separator of the file, and then click Next.
  4. Select the corresponding column in the file for each user attribute, and you can also select Not Import from File and set the parameter value. The account name must be imported from the file. Click Preview to view the first ten records.
  5. Click OK.
• Modify a Device User
  
  Perform this task to modify a device user.

  Procedure

  1. Click the User tab, and then select Device User > All Device Users from the navigation tree.
  2. Click the icon of the device user that you want to modify.
  3. Configure the parameters as needed.
  4. Click OK.
• Batch Modify Device Users
  
  Perform this task to modify device users in batches.

  Procedure

  1. Click the User tab, and then select Device User > All Device Users from the navigation tree.
  2. Use one of the following methods to batch modify device users:
  • Select device users on the list, click Batch Modify and select Modify Selected from the drop-down menu.
  • In the device user query area, enter query criteria, and then click Query. The matching device users are displayed on the device user list. Click Batch Modify and select Modify by Query Criteria from the drop-down menu.
  3. The parameters that can be modified in bulk include the login password, user authorization policy,password control strategy, expiration date, privilege-increase password and password expiration date, binded user IP address. Set these parameters as needed.
  4. Click OK.
• Batch Regroup Device Users
  
  Perform this task to move device users to a user group in batches.

  Procedure

  1. Click the User tab, and then select Device User > All Device Users from the navigation tree.
  2. Select one or more device users, and click Regroup.
  3. Select the target group.
  4. Click OK.
• Add to Denylist
  
  Perform this task to add one or more device users to the denylist. Users in denylist cannot manage devices.

  Procedure

  1. Click the User tab, and then select Device User > All Device Users from the navigation tree.
  2. Select one or more device users on the device user list, and then click Add to Denylist.
     A confirmation dialog box appears.
  3. Click OK.
• Batch Cancel Device Users
  
  Perform this task to cancel a device user. Cancelling a device user account does not delete the account from the system. Operators still can query cancelled accounts for audit operations. The system keeps cancelled accounts for a specific period of time, which is determined by the Cancelled User Lifetime parameter in System Parameters configuration, and periodically deletes the overdue cancelled accounts.

  Procedure

  1. Click the User tab, and then select Device User > All Device Users from the navigation tree.
  2. Select one or more device users on the device user list, and then click Batch Cancel.
     A confirmation dialog box appears.
  3. Click OK.
• Process Privilege-Increase Password Applications
  
  Perform this task to approve or reject the privilege-increase password applications for device users. After the password application of a device user is approved, the user can use the password for privilege elevation after logging in to a device.

  Procedure

  1. Click the User tab. From the navigation tree, select Device User > All Device Users.
  2. Select the device users whose password applications you want to approve, click Process Applications, and select Approve from the menu. The Approve Applications dialog box appears. To modify the expiration date for the requested passwords, select Modify Expiration Date, set the new password expiration date, and click OK. An empty password expiration date indicates that the password never expires.
  3. Select the device users whose password applications you want to reject, click Process Applications, select Reject from the menu, and then click OK in the confirmation dialog box.
• Batch Export
  
  Use this function to export the device user information to a file and save the file in the INC server or on your local computer.

  Procedure

  1. Click the User tab. From the navigation tree, select Device User > All Device Users.
  2. Type the query conditions and click Query. The matched device users will be displayed in the device user list. and click Batch Export.
  3. Configure related parameters and click OK.
  4. The system execute the export operation as configured, saves the exported file on the INC server, and then display the operation result page.
  5. Click Download to download and save the export file.
• Password Reminder
  
  Set a password expiration reminder time to view expiring user passwords.

  Procedure

  1. Click the User tab.
  2. From the navigation tree, select Device User > All Device Users.
  3. Click the Password reminder button.The page for setting the password expiration reminder time opens.
  4. Enter the password expiration reminder time, in the range of 1 to 365 days.
  5. To save the configuration, click OK, OR click Cancel to close the window.
  6. To view expiring user passowrds, click link "N user passwords are about to expire. Click here for details."
• Batch registering dynamic tokens
  
  Perform this task to generate dynamic token QR codes for device users in batch. Then, each device user can scan the QR code by using the dynamic token client to obtain a 6-digit dynamic token. A device user can also use the dynamic token client to register a dynamic token after providing the username and password in the client.

  Procedure

  1. Click the User tab.
  2. On the navigation tree, select Device User > All Device Users. The list displays all device users.
  3. Select device users for which you want to register dynamic tokens, and then click Batch Register Dynamic Tokens. A page that displays dynamic token QR codes for the device users opens.
  4. Each of the device users uses the dynamic token client to scan its own QR code to obtain a dynamic token.

Remarks

• A device user can belong to only one device user group.
• After a device user is added to the denylist, the online status of the user does not change, but the user can no longer log in to any device.
• By default, the last logoff time of a new user is the same as the creation time of the user.
• Export device user information by query conditions only.
• You can register a dynamic token for a device user only if embedded dynamic token authentication are enabled for the user.
• For dynamic tokens to be correctly used, make sure the time difference between the INC server and dynamic token client is not greater than 30 seconds.
• The password required for dynamic token authentication depends on the password type specified for the user. If TAM + Dynamic Passwords is specified, both the TAM password and the dynamic password are required. For example, if the TAM password is XXXX and the dynamic password is YYYYYY, the device user must enter XXXXYYYYYY. If Dynamic Password is specified, only the dynamic password is required.