Can anyone help me with understanding one thing about AAA authorization on Cisco IOS. Here is a config fragment:
aaa authorization config-commands
aaa authorization exec default group tacacs+ local
aaa authorization commands 1 default group tacacs+
aaa authorization commands 15 default group tacacs+ local
Do I understand correctly that authorization allows some commands (like "commands 15") for some users (like "group tacacs+")? So why there is no option "group" for the config-commands?
From CCO docs
If aaa authorization commands level method command is enabled, all commands, including configuration commands, are authorized by AAA using the method specified. Because there are configuration commands that are identical to some EXEC-level commands, there can be some confusion in the authorization process. Using the no aaa authorization config-commands command stops the network access server from attempting configuration command authorization.
It never really occurred to me, but the way you suggest would make more sense than the way it works. Now it just inherits the server which it should query from 'commands level' and documents are unclear which level, as they may be different, but I guess it would be level 15.
What the last line in your example config does is require level 15 commands to be authorized through tacacs+, or if tacacs+ is not available, to utilize the local database. The previous line requires authorization of level 1 commands through tacacs+ only.
It has nothing to do with specifying groups of users.
