authentication-super

Function

The authentication-super command configures an authentication mode for upgrading user levels in an authentication scheme.

The undo authentication-super command restores the default authentication mode for upgrading user levels in an authentication scheme.

By default, the super mode is used. That is, local authentication is used.

Format

authentication-super { hwtacacs | radius | super } ^* [ none ]

authentication-super none

undo authentication-super

Parameters

Parameter	Description	Value
hwtacacs	Uses HWTACACS authentication to upgrade user levels.	-
radius	Uses RADIUS authentication to upgrade user levels.	-
super	Uses local authentication to upgrade user levels.	-
none	Indicates that user levels can be upgraded without authentication.	-

Views

Authentication scheme view

Default Level

3: Management level

Usage Guidelines

Usage Scenario

If users in a domain need to upgrade their levels, the device requests the users to enter the password to authenticate the users. If AAA authentication has been configured using the authentication-mode (user interface view) command, run the authentication-super command to configure an authentication mode for upgrading user levels.

When you use the super command to switch a user level to a lower level or the same level, no authentication is required. When you use the super command to switch a user level to a higher level, authentication is required. The user can be granted rights only after being authenticated.

If super is used and the local authentication is specified, run the local-user command in the AAA view to create a local user and set parameters for the local user.
If hwtacacs is used and the HWTACACS authentication is specified, perform configurations relevant to HWTACACS authentication.
If radius is used and the RADIUS authentication is specified, perform configurations relevant to RADIUS authentication.
If none is used, no authentication is required.

Precautions

If multiple authentication modes are configured in an authentication scheme, these authentication modes are used in the sequence in which they were configured. The device uses another authentication mode only when it does not receive any response in the current authentication. The device does not switch to another authentication mode if the user fails to pass one authentication mode.

Example

# Set the authentication mode to HWTACACS authentication in the authentication scheme scheme1.

<HUAWEI> system-view
[HUAWEI] aaa
[HUAWEI-aaa] authentication-scheme scheme1
[HUAWEI-aaa-authen-scheme1] authentication-super hwtacacs