Hello,

We are trying to use Radius (Using FreeRadius specifically) for centralized user access management into our Dell S4148T-ON switches (Running 10.5.2.8 version), but have issues trying to find documentation on how to properly setup RBAC with the use of Vendor Specific Attributes with Radius.

The configuration that I have is fairly straight forward and works for basic auth:

aaa authentication login default group radius local

radius-server host **** key ****

Since I can't find any official documentation on what VSAs can be used in OS10, on older forum posts and older OS documentation I've found 3 options that seemingly worked on some hardware/software some time ago:

Cisco-avpair = "shell:priv-lvl=15"

Force10-avpair = "shell:priv-lvl=15"

DellEMC-avpair = "shell:priv-lvl=15"

When sending any of these in the Access-Accept response from the Radius server to switch, the user still only gets the lowest privilege level assigned.

According to this post Using-RADIUS-VSAs-for-RBAC - the solution is to enable authorization for radius, but on OS10 I don't seem to have this option for Radius, only for TACACS+:

Switch1(config)# aaa authorization exec-commands role sysadmin default group ?
tacacs+ To configure for tacacs server

That seemed like a possibility in OS9 according to documentation - configure-aaa-authorization-for-roles 

So my questions would be: 

• What are the supported VSAs that need to be sent in Radius responses to a switch running OS10?
• How can AAA authorization be enabled with Radius in OS10?