Cisco Cisco Access Registrar 3.5 - Manual (Page 20)

2-2
Cisco Access Registrar 3.5 Concepts and Reference Guide
OL-2683-02
Chapter 2 Understanding Cisco Access Registrar
Cisco Access Registrar Hierarchy
UserLists and Groups
Cisco Access Registrar lets you organize your user community through the configuration objects
UserLists, users, and UserGroups.
• Use UserLists to group users by organization, such as Company A and Company B. Each list
contains the actual names of the users.
• Use users to store information about particular users, such as name, password, group membership,
base profile, and so on.
• Use UserGroups to group users by function, such as PPP, Telnet, or multiprotocol users. Groups
allow you to maintain common authentication and authorization requirements in one place, and have
them referenced by many users.
For more information about UserLists and UserGroups, refer to Access Registrar Server Objects in the
Cisco Access Registrar User’s Guide.
Profiles
Cisco Access Registrar uses Profiles that allow you to group RADIUS attributes to be included in an
Access-Accept packet. These attributes include values that are appropriate for a particular user class,
such as PPP or Telnet user. The user’s base profile defines the user’s attributes, which are then added to
the response as part of the authorization process.
Although you can use Group or Profile objects in a similar manner, choosing whether to use one rather
than the other depends on your site. If you require some choice in determining how to authorize or
authenticate a user session, then creating specific profiles, and specifying a group that uses a script to
choose among the profiles is more flexible. In such a situation, you might create a default group and then
write a script that selects the appropriate profile based on the specific request. The benefit to this
technique is each user can have a single entry, and use the appropriate profile depending on the way they
log in.
For more information about Profiles, refer to Access Registrar Server Objects in the Cisco Access
Registrar User’s Guide.
Scripts
Cisco Access Registrar allows you to create scripts you can execute at various points within the
processing hierarchy.
• Incoming scripts—enable you to read and set the attributes of the request packet, and set or change
the Environment dictionary variables. You can use the environment variables to control subsequent
processing, such as specifying the use of a particular authentication service.
• Outgoing scripts—enable you to modify attributes returned in the response packet.
For more information about Scripts, refer to Access Registrar Server Objects in the Cisco Access
Registrar User’s Guide.
Services
Cisco Access Registrar uses Services to let you determine how authentication, authorization, and/or
accounting are performed.