Use this command to set the order for handling remote to local user mappings.
You can specify one of three mapping behaviors when authenticating users with a remote authentication server:
Remote First: (Default) The appliance will attempt to map the local-user mapping attribute to a local account. If a local account exists, the system will map the user to that account. If no local user exists, the system will map the user to the default user specified by the aaa authorization map default-user command.
Remote Only: The appliance will attempt to map the local-user mapping to a local account. If a local account exists, the system will map the user to that account. If no account exists, the system will deny access to the user.
Local Only: The system will map all users to the default user specified by the aaa authorization map default-user command.
Note
This mapping is only used when the user is authenticated using a remote authentication server (RADIUS, TACACS+, or LDAP). This mapping is ignored for users authenticating locally.
Syntax
[no] aaa authorization map order {remote-first | remote-only| local-only}
Parameters
no
Resets the map order to the default (remote-first)
remote-first
(Default) Sets the mapping behavior to Remote First.
remote-only
Sets the mapping behavior to Remote Only.
local-only
Sets the mapping behavior to Local Only.
Examples
The following example sets the mapping behavior to local only.
hostname (config) # aaa authorization map order local-only
The following example returns the appliance to the default mapping behavior (remote first)
hostname (config) # no aaa authorization map order
User role
Admin
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Malware Analysis: Before Release 6.4
Central Management System: Before Release 6.4
Email Security — Server: Before Release 6.4
File Protect: Before Release 6.4
Network Security: Before Release 6.4
Intelligent Virtual Execution - Server: Release 7.9