From 1c804685d05ad639bcb1a9ebce68a7a14268500f Mon Sep 17 00:00:00 2001
From: zsdc <taras@vyos.io>
Date: Wed, 13 Sep 2023 13:16:20 +0300
Subject: TACACS: T5577: Added `mandatory` and `optional` modes for TACACS+

In CLI we can choose authentication logic:

  - `mandatory` - if TACACS+ answered with `REJECT`, authentication must be
  stopped and access denied immediately.
  - `optional` (default) - if TACACS+ answers with `REJECT`, authentication
  continues using the next module.

In `mandatory` mode authentication will be stopped only if TACACS+ clearly
answered that access should be denied (no user in TACACS+ database, wrong
password, etc.). If TACACS+ is not available or other errors happen, it will be
skipped and authentication will continue with the next module, like in
`optional` mode.
---
 interface-definitions/system-login.xml.in | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

(limited to 'interface-definitions')

diff --git a/interface-definitions/system-login.xml.in b/interface-definitions/system-login.xml.in
index 71db8b1d6..30fea91b0 100644
--- a/interface-definitions/system-login.xml.in
+++ b/interface-definitions/system-login.xml.in
@@ -259,6 +259,26 @@
                   </constraint>
                 </properties>
               </leafNode>
+              <leafNode name="security-mode">
+                <properties>
+                  <help>Security mode for TACACS+ authentication</help>
+                  <completionHelp>
+                    <list>mandatory optional</list>
+                  </completionHelp>
+                  <valueHelp>
+                    <format>mandatory</format>
+                    <description>Deny access immediately if TACACS+ answers with REJECT</description>
+                  </valueHelp>
+                  <valueHelp>
+                    <format>optional</format>
+                    <description>Pass to the next authentication method if TACACS+ answers with REJECT</description>
+                  </valueHelp>
+                  <constraint>
+                    <regex>(mandatory|optional)</regex>
+                  </constraint>
+                </properties>
+                <defaultValue>optional</defaultValue>
+              </leafNode>
               #include <include/radius-timeout.xml.i>
               #include <include/interface/vrf.xml.i>
             </children>
-- 
cgit v1.2.3