Definitions of Managed Objects for IP Storage User Identity Authorization
Extracted elements (26)
Address ranges (start/end pair) are used instead of netmasks because ranges express the same constraints with greater flexibility. Applications that use netmasks may convert to/from ranges when reading or writing the MIB.
Authentication method attributes use OID values (AutonomousType) rather than enumerated integers so that vendors and other MIB modules can define new authentication methods without modifying this MIB module. Each new method registers an OBJECT-IDENTITY under ipsAuthMethodTypes or its own enterprise subtree.
Multiple rows of the same attribute type (name, address, or credential) within one identity are treated with OR logic — matching any one suffices. Rows of different types are combined with AND logic — at least one row from each non-empty category must match. Empty categories are ignored entirely.
IPS-AUTH-MIB provides only the set of identity definitions; it does not implement access control lists, login/authentication failure statistics, or notifications. Other MIB modules that require authorization must reference ipsAuthIdentAttributesTable rows via RowPointer and implement their own access list logic.
The 'user' concept in IPS-AUTH-MIB is distinct from an SNMPv3 USM user: an IPS-AUTH identity supports multiple names, addresses, and credentials combined with AND/OR logic, whereas a USM user has exactly one username, one auth protocol, and one privacy protocol. The two coexist on the same system without conflict.
Deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED. Implementors SHOULD use SNMPv3 with full cryptographic security (authentication and privacy) for access to this MIB module.
Index values (ipsAuthInstIndex, ipsAuthIdentIndex, etc.) MUST NOT be modified or reused by an agent unless a reboot has occurred, and an agent SHOULD attempt to keep index values persistent across reboots.
It is strongly RECOMMENDED that SNMPv3 with securityLevel of authPriv be used for all access to objects in this MIB module, given the sensitivity of authorization configuration it exposes.
The compliance statement ipsAuthComplianceV1 makes ipsAuthInstanceAttributesGroup and ipsAuthIdentAttributesGroup mandatory; at least one of Name, Address, Credential, or Certificate groups is also mandatory for any given implementation.
The value of ipsAuthCredAuthMethod MUST NOT be changed while its row is 'active'. Similarly, ipsAuthIdentAddrType MUST NOT be changed while the address row is 'active', because it determines the format of the start and end address fields.
When a row is created in ipsAuthCredentialAttributesTable, the management station MUST also create a corresponding row in the table specified by ipsAuthCredAuthMethod (e.g., ipsAuthCredChapAttributesTable for CHAP). When the credential row is deleted, the agent MUST automatically delete the corresponding method-specific row.
ipsAuthCredChapAttributesTable stores CHAP-specific credential data (ipsAuthCredChapUserName as SnmpAdminString); a row exists here only when the parent ipsAuthCredential row has ipsAuthCredAuthMethod = ipsAuthMethodChap.
ipsAuthCredentialAttributesTable holds credentials per identity, with ipsAuthCredAuthMethod as an AutonomousType (OID) selecting the authentication method. Each non-None method requires a corresponding row in a method-specific table (CHAP, SRP, or Kerberos).
ipsAuthCredKerbAttributesTable stores Kerberos-specific credential data (ipsAuthCredKerbPrincipal as SnmpAdminString); a row exists here only when the parent credential row has ipsAuthCredAuthMethod = ipsAuthMethodKerberos.
ipsAuthCredSrpAttributesTable stores SRP-specific credential data (ipsAuthCredSrpUserName); a row exists here only when the parent credential row has ipsAuthCredAuthMethod = ipsAuthMethodSrp.
ipsAuthIdentAddrAttributesTable represents allowed endpoint address ranges per identity, with fields ipsAuthIdentAddrType (AddressFamilyNumbers), ipsAuthIdentAddrStart, and ipsAuthIdentAddrEnd (both IpsAuthAddress). Supports IPv4, IPv6, FC-WWPN, and FC-WWNN address families.
ipsAuthIdentAttributesTable contains one row per configured user identity (ipsAuthIdentIndex, ipsAuthIdentDescription, ipsAuthIdentRowStatus, ipsAuthIdentStorageType). Other MIB modules reference identity rows via RowPointer to authorize access to their resources.
ipsAuthIdentNameAttributesTable holds UTF-8 identity names (ipsAuthIdentName as SnmpAdminString), each belonging to a specific ipsAuthIdentity. An iSCSI Initiator Name is cited as a canonical example of an identity name.
ipsAuthInstanceAttributesTable is the root table of the MIB; every other table entry includes ipsAuthInstIndex as its primary index. An instance represents a managed set of identities, supporting partitioned systems, stacked devices, or per-protocol identity sets.
ipsAuthMethodTypes (OID ipsAuthDescriptors 1) is the registration point for Authentication Method Types within the IPS-AUTH-MIB. Four initial types are registered: ipsAuthMethodNone, ipsAuthMethodSrp, ipsAuthMethodChap, and ipsAuthMethodKerberos.
The IANA assigned OID mib-2 141 to the IPS-AUTH-MIB module, placing it under the mib-2 branch of the SMI object tree.
All readable tables in this MIB reveal which names, addresses, and credentials are required to access services on the managed system. If credentials such as names or addresses can be easily spoofed, read access must be tightly controlled via SNMP access control.
Deleting an existing credential row before adding a replacement leaves an empty credential list, which the OR/AND matching logic interprets as 'any credential matches,' potentially granting unconstrained access. The recommended update patterns are: in-place field update, add-then-delete, or add-and-delete in one SNMP SET (add first).
Updating an address range by modifying start and end addresses separately (rather than atomically) can temporarily expose a wider range than intended. Applications MUST update both ipsAuthIdentAddrStart and ipsAuthIdentAddrEnd in the same SNMP set request, or add a new range row and delete the old one.
Writable objects (ipsAuthIdentRowStatus, ipsAuthCredRowStatus, ipsAuthCredAuthMethod, address fields, etc.) can be exploited to inject rogue identities, camouflage existing ones, weaken access requirements, or cause denial of service if SET operations are not protected.
IpsAuthAddress is an OCTET STRING (SIZE 0..255) whose interpretation is determined by a companion AddressFamilyNumbers object: ipV4(1) maps to InetAddressIPv4, ipV6(2) maps to InetAddressIPv6, and fibreChannelWWPN(22)/fibreChannelWWNN(23) map to FcNameIdOrZero.