3.114. <ServerTACACSPLUS> Previous topic Parent topic Child topic Next topic

This clause tells Radiator to act as a TACACS+ server as well as a RADIUS server.
TACACS+ is an older Authentication, Authorisation and Accounting (AAA) protocol developed by Cisco and supported by some Cisco devices. It uses TCP connections between the client (usually some kind of router) and the TACACS+ server. Newer Cisco devices generally support both RADIUS and TACACS+ or just RADIUS. Some older Cisco devices only support TACACS+. In addition, there are some Cisco security facilities that are only available through TACACS+.
The <ServerTACACSPLUS> clause handles TACACS+ AAA requests in the following way:
Tip
By default, Radiator requires that the user has previously authenticated with this Radiator instance before accepting any TACACS+ authorisation requests. The authentication reply provides the authorisation information Radiator needs to handle the subsequent TACACS+ authorisation requests. If the optional parameter AllowAuthorizeOnly is enabled, Radiator requests authorisation information even if the user has not previously authenticated with this Radiator instance. For more information, see Section 3.114.13. AllowAuthorizeOnly.
Tip
If <ServerTACACSPLUS> is used to authenticate administrator access to a Cisco device, you need to add specific authorisation attributes to allow administrative access. For example, to get administrative access to a Cisco Aironet wireless Access Point requires that the authorisation include a TACACS+ attribute-value pair like:
aironet:admin-capability=ident+admin
You can achieve this by having a suitable cisco-avpair reply item for the relevant user in your Radiator database:
ciscouser User-Password=fred
      cisco-avpair="aironet:admin-capability=ident+admin"
You can also achieve this by having an AuthorizationAdd parameter in your <ServerTACACSPLUS> clause:
AuthorizationAdd aironet:admin-capability=ident+admin
This example enables only some levels of administrative access (ident and admin). See your Cisco device documentation for more details.
Tip
Devices from other vendors than Cisco, such as Juniper, may also accept ciscoavpair attributes.
<ServerTACACSPLUS> can be used with any Radiator authentication method that understands plain text passwords, such as FILE, SQL, LDAP, DBFILE, and also with any method that challenge the user for additional authentication data,such as DIGIPASS, ACE, OPIE, OTP, INTERNAL.
Tip
You can use the TACACS+ test client goodies/tacacsplustest in your distribution to send test TACACS+ requests.
During request processing, <Server TACACSPLUS> looks for a Client clause that matches the origin of the TACACS+ request, as described above. If found, a number of parameters from the Client clause are used during processing: