Configuring local users

To implement local authentication, authorization, and accounting, create local users and configure user attributes on the device. The local users and attributes are stored in the local user database on the device. A local user is uniquely identified by the combination of a username and a user type. Local users are classified into the following types:

• Device management user—User who logs in to the device for device management.

• Network access user—User who accesses network resources through the device.

The following shows the configurable local user attributes:

• Service type—Services that the user can use. Local authentication checks the service types of a local user. If none of the service types is available, the user cannot pass authentication.

  Service types include FTP, HTTP, HTTPS, LAN access, portal, SSH, Telnet, and terminal.

• User state—There are two user states: active and blocked. A user in active state can request network services. A user in blocked state cannot request authentication, authorization, and accounting services, but it can request to stop the accounting service in use.

• Upper limit of concurrent logins using the same user name—Maximum number of users who can concurrently access the device by using the same user name. When the number reaches the upper limit, no more local users can access the device by using the user name.

• User group—Each local user belongs to a local user group and has all attributes of the group. The attributes include the password control attributes and authorization attributes. For more information about local user group, see "Configuring user group attributes."

• Binding attributes—Binding attributes control the scope of users, and are checked during local authentication of a user. If the attributes of a user do not match the binding attributes configured for the local user account, the user cannot pass authentication. Binding attributes include the IP address, access port, MAC address, and native VLAN. For support and usage information about binding attributes, see "Configuring local user attributes."

• Authorization attributes—Authorization attributes indicate the user's rights after it passes local authentication. Authorization attributes include the ACL, idle cut feature, user profile, user role, VLAN, and FTP/SFTP/SCP working directory. For support information about authorization attributes, see "Configuring local user attributes."

  Configure the authorization attributes based on the service type of local users.

  You can configure an authorization attribute in user group view or local user view. The setting of an authorization attribute in local user view takes precedence over the attribute setting in user group view.

  • The attribute configured in user group view takes effect on all local users in the user group.

  • The attribute configured in local user view takes effect only on the local user.

• Password control attributes—Password control attributes help control password security for device management users. Password control attributes include password aging time, minimum password length, password composition checking, password complexity checking, and login attempt limit.

  You can configure a password control attribute in system view, user group view, or local user view. A password control attribute with a smaller effective range has a higher priority. For more information about password management and global password configuration, see "Configuring password control."

When you configure local user attributes, follow these guidelines:

• When you use the password-control enable command to globally enable the password control feature, local user passwords are not displayed.

• You can configure authorization attributes and password control attributes in local user view or user group view. The setting in local user view takes precedence over the setting in user group view.

• Configure authorization attributes according to the application environments and purposes. Support for authorization attributes depends on the service types of users.

  • For LAN and portal users, only the following authorization attributes are effective: acl, user-profile, and vlan.

  • For HTTP and HTTPS users, only the authorization attribute user-role is effective.

  • For Telnet and terminal users, only the following authorization attributes are effective: idle-cut and user-role.

  • For SSH users, only the following authorization attributes are effective: idle-cut, user-role, and work-directory.

  • For FTP users, only the following authorization attributes are effective: user-role and work-directory.

  • For other types of local users, no authorization attribute is effective.

• Configure the location binding attribute based on the service types of users.

  • For 802.1X users, specify the 802.1X-enabled Layer 2 Ethernet interfaces through which the users access the device.

  • For MAC authentication users, specify the MAC authentication-enabled Layer 2 Ethernet interfaces through which the users access the device.

  • For portal users, specify the portal-enabled interfaces through which the users access the device. Specify the Layer 2 Ethernet interfaces if portal is enabled on VLAN interfaces and the portal roaming enable command is not configured.

To configure local user attributes:

User groups simplify local user configuration and management. A user group contains a group of local users and has a set of local user attributes. You can configure local user attributes for a user group to implement centralized user attributes management for the local users in the group. Local user attributes that are manageable include authorization attributes.

By default, every new local user belongs to the default user group system and has all attributes of the group. To assign a local user to a different user group, use the group command in local user view.

To configure user group attributes:

Execute display commands in any view.