Fabric OS Administrator's Guide v7.0.0 (53-1002148-02, June 2011)

114 Fabric OS Administrator’s Guide
53-1002148-02
The authentication model using RADIUS and LDAP
5
Home Admin Domain (homeAD) for the user will be the first value in the adlist (Admin
Domain list). If a user has no values assigned in the adlist attribute, then the homeAD ‘0’
will be the default administrative domain for the user.
• If you are using Virtual Fabrics, enter the value of the logical fabric separated by an
semi-colon ( ; ) into the Value field.
Example for adding Virtual Fabrics
HomeLF=10;LFRoleList=admin:128,10;ChassisRole=admin
In this example, the logical switch that would be logged into by default is 10. If 10 is not
available then the lowest FID available will be chosen. You would have permission to enter
logical switch 128 and 10 in an admin role and you would also have the chassis role
permission of admin.
NOTE
You can perform batch operations using the Ldifde.exe utility. For more information on
importing and exporting schemas, refer to your Microsoft documentation or visit
www.microsoft.com.
Adding attributes to the Active Directory schema
To create a group in Active Directory, refer to www.microsoft.com or Microsoft documentation. You
will need to verify that the schema has the following attributes:
• Add a new attribute brcdAdVfData as Unicode String.
• Add brcdAdVfData to the person’s properties.
Authentication servers on the switch
At least one RADIUS or LDAP server must be configured before you can enable RADIUS or LDAP
service. You can configure the RADIUS or LDAP service even if it is disabled on the switch. You can
configure up to five RADIUS or LDAP servers. You must be logged in as admin or switchAdmin to
configure the RADIUS service.
NOTE
On dual-CP enterprise-class platforms (Brocade DCX and DCX-4S devices), the switch sends its
RADIUS or LDAP request using the IP address of the active CP. When adding clients, add both the
active and standby CP IP addresses so that users can still log in to the switch in the event of a
failover.
RADIUS or LDAP configuration is chassis-based configuration data. On platforms containing
multiple switch instances, the configuration applies to all instances. The configuration is persistent
across reboots and firmware downloads. On a chassis-based system, the command must replicate
the configuration to the standby CP.
Multiple login sessions can invoke the command simultaneously. The last session that applies the
change is the one whose configuration is in effect. This configuration is persistent after an HA
failover.
The RADIUS or LDAP servers are contacted in the order they are listed, starting from the top of the
list and moving to the bottom.