When a remote user logs into the appliance, a remote authentication server typically determines which local user account on the appliance the remote user should use.
It uses one of the following methods to do this:
Mapping to a local user account according to rules set by the
aaa authorization map orderCLI command. The mapping can come from the local configuration or from an attribute in the remote authentication server's response.Directly from an attribute in the remote authentication server's response.
An administrator can use the aaa authorization rules rule CLI command to configure rules in the local configuration that override this mapping when the specified conditions are met. Rule criteria include the following:
Authentication type
Remote user name
Local user name (before the override)
LDAP group
LDAP search filter
The first rule that evaluates as "true" will override the initial mapping, and the remaining rules will not be considered. If a rule includes multiple criteria, every criterion must be met before the rule itself can evaluate as true. For example, if a rule specifies that the remote username must be "alice" and that the LDAP group cannot be "group_a" , the rule will evaluate as true if the user is Alice, but only if she is in a group other than Group A.
For more information, see Locally overriding temote user mappings using the CLI.