authentication super

Use authentication super to specify a method for user role authentication.

Use undo authentication super to restore the default.


authentication super { hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name } *

undo authentication super


The default authentication methods of the ISP domain are used for user role authentication.


ISP domain view

Predefined user roles




hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

To enable a user to obtain another user role without reconnecting to the device, you must configure user role authentication. The device supports local and remote methods for user role authentication. For more information about user role authentication, see RBAC configuration in Fundamentals Configuration Guide.

You can specify one authentication method and one backup authentication method to use in case that the previous authentication method is invalid.


# In ISP domain test, perform user role authentication based on HWTACACS scheme tac.

<Sysname> system-view
[Sysname] super authentication-mode scheme
[Sysname] domain test
[Sysname-isp-test] authentication super hwtacacs-scheme tac

Related commands

authentication default

hwtacacs scheme

radius scheme