show aaa authorization rules

Shows all configured authorization rules in the local configuration to override the local user account. A remote authentication server determines which method remote users can use to log in to an appliance. You can verify whether all authorization rules are enabled or disabled.

Syntax

show aaa authorization rules

Parameters

None

Example

The following example shows eight rules configured with different matching criteria.

hostname # show aaa authorization rules

------------------------------------------------
#         AAA Authorization Rules : Enabled
------------------------------------------------
# Rule          Statements
------------------------------------------------

# 1
Match Auth Methods        : ldap
Match LDAP Group          : cn=test_group,ou=groups,dc=vps1,dc=eng,dc=company1,dc=com
-->Action Map Local User  : test_user1

# 2
Match Remote Users        : rem_user1 rem_user2 rem_user3
Match Map Local Users     : loc_user1 loc_user2
-->Action Map Local User  : test_user2

# 3
Match Auth Methods       : radius
Not-Match Remote Users   : rem_user1 rem_user2
-->Action Map Local User : test_user3

# 4
Not-Match Auth Methods   : tacacs+
Match Map Local Users    : loc_user1 loc_user4
-->Action Map Local User : test_user4

# 5
Match Auth Methods       : ldap
Match LDAP Search Filter : (memberOf=CN=TechUsers,OU=Security Groups,OU=Milpitas,OU=United States,OU=Locations,DC=Company1,DC=com)
-->Action Map Local User : test_user5

# 6
Match Auth Methods       : ldap
Not-Match Map Local Users: loc_user1
Not-Match LDAP Group     : cn=test_group,ou=groups,dc=vps1,dc=eng,dc=company1,dc=com
-->Action Map Local User : test_user3

# 7
Match Auth Methods       : remote
Not-Match Remote Users   : rem_user4
-->Action Map Local User : test_user6

# 8
Match Auth Methods       : radius tacacs+
Match Remote Users       : rem_user1
-->Action Map Local User : test_user5

The following example shows the new authorization rules that are matched using the X.509 certificate authentication method.

hostname # show aaa authorization rules
 ------------------------------------------------
 #         AAA Authorization Rules : Enabled
 ------------------------------------------------
 # Rule          Statements
 ------------------------------------------------
 # 1        Match Auth Methods                 : x509-cert
         -->Action Map Local User              : monitor
 # 2        Match x509 Cert Subject            : C=US, ST=CA, L=Milpitas, O=FireEye, OU=Engineering, CN=Test Cardholder
         -->Action Map Local User              : monitor

User role

Admin, Operator, or Monitor

Command mode

Enable

Supported appliances

This command is supported on the following appliances running the specified releases or later: