Manualshelf

Users Guide

ManualsBrandsDell ManualsAccess PlatformsW-Series Controller AOS
381382383384385386387388389390
Table Of Contents
383| Roles and Policies Dell Networking W-Series ArubaOS 6.5.x| User Guide
4. The user role can be derived from attributes returned by the authentication server and certain client
attributes (this is known as a server-derived role). If the client is authenticated via an authentication server,
the user role for the client can be based on one or more attributes returned by the server during
authentication, or on client attributes such as SSID (even if the attribute is not returned by the server).
Server-derivation rules are executed after client authentication.
5. The user role can be derived from Dell Vendor-Specific Attributes (VSA) for RADIUS server authentication. A
role derived from a Dell VSA takes precedence over any other user roles.
The following sections describe the methods of assigning user roles.
Assigning User Roles in AAA Profiles
An AAA profile defines the user role for unauthenticated clients (initial role) as well as the default user role for
MAC and 802.1X authentication. For additional information on creating AAA profiles, see
WLAN Authentication
on page 436.
In the WebUI
1. Navigate to the Configuration > Security > Authentication > AAA Profiles page.
2. Select the default profile or a user-defined AAA profile.
3. Click the Initial Role drop-down list, and select the desired user role for unauthenticated users.
4. Click the 802.1X Authentication Default Role drop-down list and select the desired user role for users
who have completed 802.1X authentication.
5. Click the MAC Authentication Default Role drop-down list and select the desired user role for clients
who have completed MAC authentication.
6. Click Apply.
In the CLI
(host)(config) #aaa profile <profile>
Working with User-Derived VLANs
Attributes derived from the client’s association with an AP can be used to assign the client to a specific role or
VLAN, as user-derivation rules are executed before the client is authenticated.
You configure the user role or VLAN to be assigned to the client by specifying condition rules; when a condition
is met, the specified user role or VLAN is assigned to the client. You can specify more than one condition rule;
the order of rules is important as the first matching condition is applied. You can optionally add a description
of the user rule.
Table 81 describes the conditions for which you can specify a user role or VLAN.