access-user login session-limit reply

Function

The access-user login session-limit reply command configures the error code and message returned by the device to the portal server if web users switch from the pre-authentication domain to the authentication domain and the number of users using the same account has reached the upper limit.

The undo access-user login session-limit reply command restores the default configuration.

By default, if web users switch from the pre-authentication domain to the authentication domain and the number of users using the same account has reached the upper limit, the device returns the error code 1 (indicating that the authentication request is rejected) and a message with the content of the Reply-Message attribute received from the RADIUS server to the portal server.

This command is supported only on the NetEngine 8000 F1A.

Format

access-user login session-limit reply error-code message

undo access-user login session-limit reply [ error-code message ]

Parameters

Parameter	Description	Value
error-code	Specifies the error code returned by the device to the portal server.	The value is an integer that ranges from 1 to 255.
message	Specifies the message returned by the device to the portal server.	The value is a string of 1 to 63 characters, spaces supported.

Parameter

Description

Value

error-code

Specifies the error code returned by the device to the portal server.

The value is an integer that ranges from 1 to 255.

message

Specifies the message returned by the device to the portal server.

The value is a string of 1 to 63 characters, spaces supported.

Views

AAA view

Default Level

2: Configuration level

Task Name and Operations

Task Name	Operations
aaa-access	write

Usage Guidelines

The RADIUS server does not limit the maximum number of access users using the same account. As long as the user name and password are correct, the users can be authenticated by the RADIUS server, and the RADIUS server returns a message with the content of the Reply-Message attribute to the device. If the user-max-session command is configured on the device, the maximum number of access users using the same account is limited according to the configured value after web users switch from the pre-authentication domain to the authentication domain. If the number of users using the same account has reached the upper limit, excess users fail to log in to the device even though the RADIUS authentication succeeds. By default, the device returns the error code 1 and a message with the content of the Reply-Message attribute received from the RADIUS server to the portal server as the device does in a RADIUS authentication reject scenario. The portal server cannot use error codes to distinguish the RADIUS authentication reject scenario from the scenario where the RADIUS authentication succeeds but the number of users using the same account has reached the upper limit. To allow the portal server to distinguish the two scenarios, you can run the access-user login session-limit reply command to configure the error code and message returned by the device to the portal server if web users switch from the pre-authentication domain to the authentication domain and the number of users using the same account has reached the upper limit.

Example

# Configure the device to return the error code 1 and the message Up to user max session to the portal server if web users switch from the pre-authentication domain to the authentication domain and the number of users using the same account has reached the upper limit.

<HUAWEI> system-view
[~HUAWEI] aaa
[~HUAWEI-aaa] access-user login session-limit reply 5 message Up to user max session