AAA user privilege doesn't work properly when changing user role

General
1

Hello, Team,

I am facing an issue relevant to AAA: When I changed a user’s role, looks like its privilege doesn’t sync up.
There two user roles: 1) Administrator, which is allowed to access all user information. 2) Operator, it’s only allowed to access its own detailed information.

The scenario as below:

  1. Logged into CLI with Administrator, I created a user of test4 with role of Operator. And then login CLI with test4 to retrieve user information, only test4’s information shown:
    test4@localhost> show system aaa authentication users
    PASSWORD USER LAST
    USERNAME USERNAME PASSWORD HASHED ROLE STATUS LOGIN

admin - - - - - -
test1 - - - - - -
test2 - - - - - -
test4 test4 - - Operator - -

  1. Change test4’s role to Administrator, I can see that its role already changed to Administrator, but still only access its own information:
    test4@localhost> show system aaa authentication users
    PASSWORD USER LAST
    USERNAME USERNAME PASSWORD HASHED ROLE STATUS LOGIN

admin - - - - - -
test1 - - - - - -
test2 - - - - - -
test4 test4 - - Administrator - -

  1. when I logout from CLI and re-login, everything now is as expected:
    test4@localhost> show system aaa authentication users
    PASSWORD
    USERNAME USERNAME PASSWORD HASHED ROLE USER STATUS LAST LOGIN

admin admin - - Administrator USER_STATUS_ENABLED 1621213428551317680
test1 test1 - - Operator USER_STATUS_ENABLED 0
test2 test2 - - Operator USER_STATUS_ENABLED 0
test4 test4 - - Administrator USER_STATUS_ENABLED 1621213549107633206

Looks like the CLI session cached user information and doesn’t sync-up from Netconf server. BTW, I use the confd internal AAA feature and it doesn’t make any difference even invoking “maapi_aaa_reload” on the application on user’s role changing.

Could you shed some light on how it work like this?

2

This is expected behavior, quoting from the User Guide:

It is worth mentioning that when a user session is initially created it will gather the authorization rules that are relevant for that user session and keep these rules for the life of the user session. Thus when we update the AAA rules in e.g. the CLI the update will not apply to the current session - only to future user sessions.

If you for whatever reason need the authorization to be so dynamic, you may try authorization callbacks.

3

Note that the using the authorization callback will slow down the system significantly as all user read, write, execs will require a callback invocation.

You may instead want to consider killing the users session to have the user log in again with the new AAA rules. For example using maapi_kill_user_session()

4

Thanks mvf,
Actually I already done this. In some cases the callback accepts or rejects the requests explicitly, but in most cases it just return confd_access_result_default/continue and let internal nacm to make the decision based on the complicated static rules from aaa_init.xml. I don’t want to implement the full rules since it’s too tedious. So, Is there any way to force refreshing authorization data for a session?

5

No, there is no way to do that. Authorization state of a user session is set at the initial login time and cannot be changed.