AAA-Domain Stripping at Server Group Level

The AAA-Domain Stripping at Server Group Level feature allows domain stripping to be configured at the server group level.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Information About AAA-Domain Stripping at Server Group Level

You can remove the domain name from the username received at the global level by using the radius-server domain-stripping command. When the radius-server domain-stripping command is configured, all the AAA requests with “user@example.com” go to the remote RADIUS server with the reformatted username “user”. The domain name is removed from the request.


Note

Domain stripping will not be done in a TACACS configuration.

The AAA Broadcast Accounting feature allows accounting information to be sent to multiple AAA servers at the same time, that is, accounting information can be broadcast to one or more AAA servers simultaneously. This functionality allows you to send accounting information to private and public AAA servers. It also provides redundant billing information for voice applications.

You can configure domain stripping at the server group level by using the domain-stripping command in server group RADIUS configuration mode. Per-server group configuration overrides the global configuration. If domain stripping is not enabled globally, but it is enabled in a server group, then it is enabled only for that server group. Also, if virtual routing and forwarding (VRF)-specific domain stripping is configured globally and in a server group for a different VRF, domain stripping is enabled in both the VRFs. VRF configurations are taken from server-group configuration mode. If server-group configurations are disabled in global configuration mode but are available in server-group configuration mode, all configurations in server-group configuration mode are applicable.

After the domain stripping and broadcast accounting are configured, you can create separate accounting records as per the configurations.

How to Configure AAA-Domain Stripping at Server Level Group

Configuring Domain Stripping at the Server Group Level

SUMMARY STEPS

    1.    enable

    2.    configure terminal

    3.    aaa new-model

    4.    aaa group server radius server-name

    5.    domain-stripping [strip-suffix word] [right-to-left ] [prefix-delimiter word] [delimiter word]

    6.    end


DETAILED STEPS
     Command or ActionPurpose
    Step 1 enable


    Example:
    Device> enable
     
    Enables privileged EXEC mode.

    • Enter your password if prompted.

     
    Step 2configure terminal


    Example:
    Device# configure terminal
     

    Enters global configuration mode.

     
    Step 3aaa new-model


    Example:
    Device(config)# aaa new-model
     

    Enables AAA.

     
    Step 4aaa group server radius server-name


    Example:
    Device(config)# aaa group server radius rad1
     
    Adds the RADIUS server and enters server group RADIUS configuration mode.

    • The server-name argument specifies the RADIUS server group name.

     
    Step 5domain-stripping [strip-suffix word] [right-to-left ] [prefix-delimiter word] [delimiter word]


    Example:
    Device(config-sg-radius)# domain-stripping delimiter username@example.com
     

    Configures domain stripping at the server group level.

     
    Step 6end


    Example:
    Device(config-sg-radius)# end
     

    Exits server group RADIUS configuration mode and returns to the privileged EXEC mode.

     

    Configuration Example for AAA-Domain Stripping at Server Group Level

    Example: AAA-Domain Stripping at Server Group Level

    The following example shows the domain stripping configuration at the server group level: 

    Device> enable
Device# configure terminal
Device(config)# aaa new-model
Device(config)# aaa group server radius rad1
Device(config-sg-radius)# domain-stripping right-to-left delimiter @$/
Device(config-sg-radius)# end

    Additional References

    The following sections provide references related to the Configuring Authentication feature.

    Related Documents

    Related Topic

    Document Title

    Authorization

    Configuring Authorization in the Cisco IOS XE Security Configuration Guide: Securing User Services, Release 2.

    Accounting

    Configuring Accounting in the Cisco IOS XE Security Configuration Guide: Securing User Service , Release 2.

    Security commands

    Cisco IOS Security Command Reference

    Standards

    Standard

    Title

    No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.

    --

    MIBs

    MIB

    MIBs Link

    No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

    To locate and download MIBs for selected platforms, Cisco IOS XE software releases, and feature sets, use Cisco MIB Locator found at the following URL:

    http:/​/​www.cisco.com/​go/​mibs

    RFCs

    RFC

    Title

    RFC 1334

    PPP Authentication Protocols

    RFC 2433

    Microsoft PPP CHAP Extensions

    RFC 2903

    Generic AAA Architecture

    RFC 2904

    AAA Authorization Framework

    RFC 2906

    AAA Authorization Requirements

    RFC 2989

    Criteria for Evaluating AAA Protocols for Network Access

    Technical Assistance

    Description

    Link

    The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

    To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

    Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

    http:/​/​www.cisco.com/​techsupport

    Feature Information for AAA-Domain Stripping at Server Group Level

    The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

    Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.
    Table 1 Feature Information for AAA-Domain Stripping at Server Group Level

    Feature Name

    Releases

    Feature Information

    AAA-Domain Stripping at Server Group Level

    Cisco IOS XE Release 3.4S

    The AAA-Domain Stripping at Server Group Level feature allows domain stripping to be configured at the server group level.

    The following command was introduced: domain-stripping.