diff options
| author | Aaron Tan <jangsutsr@gmail.com> | 2017-05-09 22:36:50 +0200 |
|---|---|---|
| committer | Aaron Tan <jangsutsr@gmail.com> | 2017-05-09 22:36:50 +0200 |
| commit | f5e58922ab7b888cf4dd7b7e769719851f2c7169 (patch) | |
| tree | 07faa981c56da681fbfe528d53afa231aed5776d /docs/auth | |
| parent | Merge pull request #6213 from ryanpetrello/new_credential_model (diff) | |
| download | awx-f5e58922ab7b888cf4dd7b7e769719851f2c7169.tar.xz awx-f5e58922ab7b888cf4dd7b7e769719851f2c7169.zip | |
Create tacacs and radius users with password disabled.
Diffstat (limited to 'docs/auth')
| -rw-r--r-- | docs/auth/README.md | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/docs/auth/README.md b/docs/auth/README.md index 6c01ce7b67..f6470e74fd 100644 --- a/docs/auth/README.md +++ b/docs/auth/README.md @@ -14,3 +14,6 @@ On the other hand, the rest of authentication methods use the same types of logi * SAML Tower will try authenticating against each enabled authentication method *in the specified order*, meaning if the same username and password is valid in multiple enabled auth methods (For example, both LDAP and TACACS+), Tower will only use the first positive match (In the above example, log a user in via LDAP and skip TACACS+). + +## Notes: +* TACACS+/RADIUS users and normal Tower users are strictly separated. For example, suppose there is a TACACS+ user with username 'Alice' which is known to TACACS+ backend but not Tower. If a user record with the same username 'Alice' is created in Tower before any log in attempt, Tower will always use its own authentication backend to authenticate Alice, even if TACACS+ backend is also available. On the other hand, if a successful log in attempt is conducted before any explicit user creation in Tower, a TACACS+ user 'Alice' is automatically created and Tower will always use TACACS+ backend for authenticating 'Alice'. |