This command enables or disables the match-criteria inheritance support. Check the current status by issuing the show identity-management command.
| role |
User role. |
| match-criteria |
Match criteria for the role. |
| inheritance |
Inheriting match criteria from parent role to child role. |
| on | off |
Specifies whether match criteria inheritance is on or off. |
Off.
From ExtremeXOS Release 15.2, child roles can inherit the match criteria of the parent role. This helps the user since the match criteria need not be duplicated in all levels of hierarchy.
When match-criteria inheritance is on, for a user to be classified under a child role, he has to satisfy the match criteria of the child role, and also all parent roles in the hierarchy.
Match criteria inheritance helps users in avoiding the need to duplicate match-criteria entries in the hierarchy.
For example, there are roles called Employee, USEmployee and USSales in an organization hierarchy of a company XYZCorp.com. Till EXOS 15.1 (or with match-criteria inheritance off), the user has to create three roles like this:
* Switch.1 # create identity-management role Employee match-criteria “company == XYZCorp.com;” * Switch.2 # create identity-management role USEmployee match-criteria “company == XYZCorp.com; AND country == USA;” * Switch.3 # create identity-management role USSales match-criteria “company == XYZCorp.com; AND country == USA; AND department = Sales” * Switch.4 # configure identity-management role "Employee" add child-role "USEmployee" * Switch.5 # configure identity-management role "USEmployee" add child-role "USSales"
Now this can be simplified into the following since child role inherits parent role‘s match criteria:
* Switch.1 # configure identity-management role match-criteria inheritance on * Switch.2 # create identity-management role Employee match-criteria “company == XYZCorp.com;” * Switch.3 # create identity-management role USEmployee match-criteria “country == USA;” * Switch.4 # create identity-management role USSales match-criteria “department = Sales” * Switch.5 # configure identity-management role "Employee" add child-role "USEmployee" * Switch.6 # configure identity-management role "USEmployee" add child-role "USSales"
This command was first available in ExtremeXOS 15.2
This command is available on the Summit X450-G2, X460-G2, X670-G2, X770, and ExtremeSwitching X440-G2, X620, X690, X870 series switches.
Print
this page
Email this topic
Feedback
View PDF
Download EPUB