Authorization

Is a method of providing certain privileges or rights to remote users. Example can be about  access to the floors. After you pass gateway in your company (authorization) you are entering to the elevator. Now you can use your badge to unlock floors. And you are authorized only to access floor number 4 and 5. But building has 7 floors. So you don’t have full access but is restricted.

The following steps needed for authorization:

  1.  AAA assembles a set of attributes based on the services that a user is requesting authorizatio0n to perform.
  2. These attributes are compared against database that contains user permission
  3.  After user is verified to be, or not to be, authorized, the result is returned to the AAA process.
  4.  After the preceding step sequence, the AAA process is then able to impose the proper restriction to the user data
  5. If the user’s authorizations are located on a remote server, they are usually determined by comparing to Attribute-Value (AV)

A method list configures authentication and is also configured to define methods of authorization. Authorization requires authentication.

 

 

Sources:

Cisco Access Control Security: AAA Administrative Services [Brandon Carroll]