Using Authentication, Authorization, and Accounting Services to Dynamically Provision View-Based Access Control Model User-to-Group Mappings
Extracted elements (18)
The approach leverages the RADIUS Management-Policy-Id Attribute (RFC 5607) bound to an authenticated session to compute dynamic VACM updates, because RADIUS does not separate authorization from authentication as the SNMP architecture does.
The memo addresses the use case where organizational roles (VACM groups) change infrequently, but user-to-role assignments change frequently. Delegating the user-to-group mapping to RADIUS avoids re-provisioning managed devices as users are added, deleted, or reassigned.
The MIB module defines no read-write or read-create objects, eliminating the risk that an intruder can alter or create management objects via direct SNMP SET operations. All dynamic updates are driven solely by internal session establishment and termination procedures.
Although motivated by RADIUS and the SSH Transport Model, the mechanism MAY be used with any AAA service and transport model that provides session establishment/termination indications, an authenticated securityName, and a group-name equivalent to the RADIUS Management-Policy-Id Attribute.
All four pieces of information (SnmpSecurityModel, RADIUS User-Name, session identifier, and RADIUS Management-Policy-Id) are REQUIRED to process a session establishment indication; if User-Name or Management-Policy-Id is absent, invalid, or zero-length, no further processing is undertaken.
Entries in the vacmAaaSecurityToGroupTable MUST NOT persist across system reboots.
Handling of a session establishment indication MUST be completed before isAccessAllowed() is invoked for any SNMP PDUs from that session, to ensure correct access control processing.
If a corresponding entry in vacmSecurityToGroupTable has a StorageType other than 'volatile' or a RowStatus other than 'active', then vacmGroupName MUST NOT be modified by the AAA-driven update procedure.
The vacmAaaSessionID value MUST be unique among all currently open sessions of all of the SNMP engine's transport models; implementations where tmSessionID has a compatible syntax and is globally unique MAY use that value.
When the last vacmAaaSecurityToGroupTable row for a (vacmAaaSecurityModel, vacmAaaSecurityName) pair is deleted on session termination, the corresponding vacmSecurityToGroupTable row with StorageType 'volatile' and RowStatus 'active' MUST be deleted as well.
The vacmAaaSecurityToGroupTable is indexed by (vacmAaaSecurityModel, vacmAaaSecurityName, vacmAaaSessionID) and holds one row per active AAA-authorized session, mapping the principal's security model and name to a VACM group name.
IANA assigned OID { mib-2 199 } to the vacmAaaMIB MODULE-IDENTITY, recorded in the SMI Numbers registry.
Inconsistent reuse of the same principal name for different entities in both pre-configured vacmSecurityToGroupTable entries and AAA-driven entries can result in incorrect access control policy being applied, potentially granting greater or lesser rights than intended, with no detection by the SNMP engine.
The procedures heuristically use StorageType 'volatile' to distinguish dynamically provisioned VACM entries from administrator-provisioned ones; entries with non-volatile StorageType are not overridden. This assumption may not be universally valid (e.g., an administrator could mistakenly create volatile entries).
The vacmAaaSecurityToGroupTable is potentially sensitive in its entirety: walking it reveals user names, security models, session identifiers, and group names. SNMPv3 with cryptographic authentication and privacy is RECOMMENDED; deployment of pre-SNMPv3 SNMP versions is NOT RECOMMENDED.
VACM's design ensures that an unknown group name grants no access, so regardless of what the AAA server provides, no user can gain SNMP access rights beyond what is already configured in VACM group policies.
On session establishment: create or update a vacmAaaSecurityToGroupTable entry, then create a corresponding vacmSecurityToGroupTable entry (StorageType 'volatile', RowStatus 'active') if none exists. On session termination: delete matching vacmAaaSecurityToGroupTable entries, and if the last entry for a (securityModel, securityName) pair is removed, delete the corresponding volatile/active vacmSecurityToGroupTable row.
vacmAaaSecurityModel is typed as SnmpSecurityModel(1..2147483647) — the 'any' (0) value is explicitly prohibited. vacmAaaSecurityName is SnmpAdminString (SIZE 1..32). vacmAaaSessionID is Unsigned32, unique across all open sessions of all transport models. vacmAaaGroupName is SnmpAdminString (SIZE 1..32).