HP-USER-AUTH

All MIBs › HP-USER-AUTH

Organization: HP Networking

Last Updated: 2017-10-12

Category: Domain: Security, RADIUS and AAA, Vendor: HP/HPE

Description: HP SNMP MIB for user authentication management on HP networking devices supporting local, RADIUS, and TACACS+ authentication.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HP-USER-AUTH?

HP-USER-AUTH is HP's proprietary MIB covering the user-authentication subsystems on its networking devices, explicitly naming three subsystems: WebAuth (web-based login), MacAuth (MAC address-based authentication), and CLI password authentication, each of which can be backed by local, RADIUS, or TACACS+ credential stores. It exposes configuration and status for these authentication mechanisms rather than general device telemetry. Its status-monitoring focus is software/service-oriented: whether each authentication method is enabled and which backend it is using are the primary things an operator would check, functioning as a check on the device's access-control posture rather than its physical health. It relies on the standard RADIUS (RFC 2865) and TACACS+ protocols as the external authentication backends it can be configured against. It is deployed on HP/Aruba networking switches and wireless access points that enforce port- or web-based network access control (NAC-style authentication) for connecting users and devices. Engineers can download the HP-USER-AUTH file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HP-USER-AUTH. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

HP/Aruba networking switch or wireless access point

Monitoring Examples

No sample objects were provided for this module, so a concrete polling scenario with real object names cannot be constructed; consistent with the module description, monitoring would involve checking the enabled/disabled state and configured backend (local, RADIUS, or TACACS+) for WebAuth, MacAuth, and CLI password authentication to confirm the intended access-control policy is actually in effect.

What Can Be Monitored

WebAuth authentication status
MAC-based authentication status
CLI login authentication status
authentication backend configuration (local/RADIUS/TACACS+)

Imported Objects

From HP-AUTZ-MIB

HpAutzUserRoleName

From HP-ICF-OID

hpSwitch

OBJECT-IDENTITY

From IF-MIB

InterfaceIndex

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From Q-BRIDGE-MIB

VlanIndex

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
DisplayString
MacAddress
RowStatus
TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using hpicfUsrAuthRedirectServerAuthFailureStats OID:

Select a HP/Aruba networking switch or wireless access point (WebAuth/MacAuth/CLI auth) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hpicfUsrAuthRedirectServerAuthFailureStats into the Find box to locate it in the OID tree, then select it and click OK. The total number of times clients fail authentication and initiate the authentication Redirect Server process since reboot. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases between polls, since a rising count of errors, failures, or discards often points to a real underlying problem. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
hpicfUsrAuthMIB	1.3.6.1.4.1.11.2.14.11.5.1.19			This MIB module contains the definitions of Managed Objects for various subsystems that perform user authentication. The subsystems under control by this MIB are: WebAuth - Web-based login authentication MacAuth - MAC address-based authentication CLI Password - CLI-based login authentication
hpicfUsrAuthNotifications	1.3.6.1.4.1.11.2.14.11.5.1.19.0
NTF hpicfUsrAuthCLIAuthFail	1.3.6.1.4.1.11.2.14.11.5.1.19.0.1			This notification signifies that CLI password authentication has failed. Operational control of this notification is provided using hpicfUsrAuthCliNotifyEnable. Agents complying with hpicfUsrAuthCompliance6 always additionally include hpicfUsrAuthLastLoginStatus. They may include hpicfUsrAuthLastLoginNotifyAddrType and hpicfUsrAuthLastLoginNotifyAddr to identify the source of the login attempt. They may also include an instance of hpicfUsrAuthLastLoginGeneration. The hpicfUsrAuthLastLoginEntry index in this object may be used to retrieve other objects in the row that identify the target user of this login attempt. If this index is zero, then the login attempt was to an unknown username. The value of hpicfUsrAuthLastLoginGeneration supplied in the notification should be compared to the retrieved object value to ensure that the row has not changed since the notification was sent.
NTF hpicfUsrAuthPasswdChng	1.3.6.1.4.1.11.2.14.11.5.1.19.0.2			An hpicfUsrAuthPasswdChng notification signifies that the manager password has been changed. The value of hpicfUsrAuthCLIPasswdSet can be used to determine whether the password has been set or cleared by this action.
NTF hpicfPortSecAuthFailure	1.3.6.1.4.1.11.2.14.11.5.1.19.0.3			This notification indicates a failed Port Security (network access) authentication event.
hpicfUsrAuthSystem	1.3.6.1.4.1.11.2.14.11.5.1.19.1
IP hpicfUsrAuthWebAuthDhcpBaseAddress	1.3.6.1.4.1.11.2.14.11.5.1.19.1.1	IpAddress	read-write	For all ports running with web authentication enabled: Specifies the base address that should be used by the switch DHCP server for web-based authentication purposes.
IP hpicfUsrAuthWebAuthDhcpMask	1.3.6.1.4.1.11.2.14.11.5.1.19.1.2	IpAddress	read-write	For all ports running with web authentication enabled: Specifies the subnet mask to be used in conjunction with the DHCP base address when servicing DHCP requests. Allowable mask range is 255.255.240.0 (20) to 255.255.255.0 (24).
I32 hpicfUsrAuthWebAuthDhcpLease	1.3.6.1.4.1.11.2.14.11.5.1.19.1.3	Integer32	read-write	For all ports running with web authentication enabled: Specifies the DHCP lease length in seconds.
INT hpicfUsrAuthMacAuthAddrFormat	1.3.6.1.4.1.11.2.14.11.5.1.19.1.4	INTEGER	read-write	For all ports running with MAC authentication enabled: Specifies the MAC address format to use in the RADIUS access-request, as follows: 'noDelimiter' - Sends MAC address in aabbccddeeff format 'singleDash' - Sends MAC address in aabbcc-ddeeff format 'multiDash' - Sends MAC address in aa-bb-cc-dd-ee-ff format 'multiColon' - Sends MAC address in aa:bb:cc:dd:ee:ff format 'noDelimiterUppercase' - Sends MAC address in AABBCCDDEEFF format 'singleDashUppercase' - Sends MAC address in AABBCC-DDEEFF format 'multiDashUppercase' - Sends MAC address in AA-BB-CC-DD-EE-FF format 'multiColonUppercase' - Sends MAC address in AA:BB:CC:DD:EE:FF format The default value is noDelimiter(1).
INT hpicfUsrAuthCliNotifyEnable	1.3.6.1.4.1.11.2.14.11.5.1.19.1.5	INTEGER	read-write	The operational status of hpicfUsrAuthCliAuthFail notifications. The default value is 1 (Enabled). A value of 2 represents Disabled. Writing this object requires authentication, such as provided by SNMPv3.
INT hpicfUsrAuthCLIInterface	1.3.6.1.4.1.11.2.14.11.5.1.19.1.6	INTEGER	accessible-for-notify	The physical interface, network protocol, or other authentication type that is associated with this notification.
T/F hpicfUsrAuthCLIPasswdSet	1.3.6.1.4.1.11.2.14.11.5.1.19.1.7	TruthValue	accessible-for-notify	Indicates whether the CLI manager password is set. 1 indicates True while 2 indicates False.
I32 hpicfUsrAuthCLIFailCnt	1.3.6.1.4.1.11.2.14.11.5.1.19.1.8	Integer32	accessible-for-notify	The count of hpicfUsrAuthPasswdFail notifications sent by the hpicfUsrAuth entity to the SNMP entity. The actual count of notifications sent by SNMP may be lower due to rate limiting or configuration.
U32 hpicfUsrAuthCLIPwdNotifyCnt	1.3.6.1.4.1.11.2.14.11.5.1.19.1.9	Unsigned32	accessible-for-notify	A count of CLI password change notifications sent from the Auth entity to the SNMP entity within the switch. This count may therefore differ from the count of notifications actually sent by the SNMP entity due to switch configuration (e.g., the value of hpicfUsrAuthNotifyEnable.)
U32 hpicfUsrAuthWMAFailCnt	1.3.6.1.4.1.11.2.14.11.5.1.19.1.10	Unsigned32	accessible-for-notify	The count of hpicfPortSecAuthFailure notifications sent by the hpicfUsrAuth entity to the SNMP entity. The actual count of notifications sent by SNMP may be lower due to rate limiting or configuration.
MAC hpicfUsrAuthWMAFailMAC	1.3.6.1.4.1.11.2.14.11.5.1.19.1.11	MacAddress	accessible-for-notify	The MAC address supplied in the failed authentication request.
I32 hpicfUsrAuthWMAFailPort	1.3.6.1.4.1.11.2.14.11.5.1.19.1.12	Integer32	accessible-for-notify	The port index of the failed authentication request.
I32 hpicfUsrAuthWMAFailVlan	1.3.6.1.4.1.11.2.14.11.5.1.19.1.13	Integer32	accessible-for-notify	The VLAN ID associated with the failed authentication request.
INT hpicfUsrAuthPortSecNotifyEnable	1.3.6.1.4.1.11.2.14.11.5.1.19.1.14	INTEGER	read-write	Provides operational control of hpicfPortSecAuthFailure notification. When enabled (1), the notification will be sent. When disabled (2), the notification will not be sent. Setting this object requires authentication, such as provided by SNMPv3.
INT hpicfUsrAuthPasswdNotifyEnable	1.3.6.1.4.1.11.2.14.11.5.1.19.1.15	INTEGER	read-write	Provides operational control of hpicfUsrAuthPasswdChng notification. When enabled (1), the notification will be sent. When disabled (2), the notification will not be sent. Setting this object requires authentication, such as provided by SNMPv3.
hpicfUsrAuthWMAEWAServerTable	1.3.6.1.4.1.11.2.14.11.5.1.19.1.16		not-accessible	A table of the Enhanced Web Auth servers.
hpicfUsrAuthWMAEWAServerEntry	1.3.6.1.4.1.11.2.14.11.5.1.19.1.16.1		not-accessible	Addresses for an Enhanced Web Auth server.
I32 hpicfUsrAuthWMAeWAServerIndex	1.3.6.1.4.1.11.2.14.11.5.1.19.1.16.1.1	Integer32	not-accessible	Index into hpicfUsrAuthWMAEWAServerTable.
IPt hpicfUsrAuthWMAeWAServerIPAddressType	1.3.6.1.4.1.11.2.14.11.5.1.19.1.16.1.2	InetAddressType	read-create	The type of Enhanced Web Auth Server Address.
IP hpicfUsrAuthWMAeWAServerIPAddress	1.3.6.1.4.1.11.2.14.11.5.1.19.1.16.1.3	InetAddress	read-create	The IP address of the Enhanced Web Auth Server. If set to 0.0.0.0 or URL not configured no Enhanced Web Auth Server will run.
OCT hpicfUsrAuthWMAeWAServerPath	1.3.6.1.4.1.11.2.14.11.5.1.19.1.16.1.4	OCTET STRING	read-create	The Enhanced Web Auth Server Path for the location of the Enhanced Web Auth Pages. If not configured the default path will be used.
ROW hpicfUsrAUthWMAeWAServerRowStatus	1.3.6.1.4.1.11.2.14.11.5.1.19.1.16.1.5	RowStatus	read-create	This marks the row as active/inactive.
hpicfUsrAuthRedirectServerTable	1.3.6.1.4.1.11.2.14.11.5.1.19.1.17		not-accessible	A table of the authentication Redirect Servers.
hpicfUsrAuthRedirectServerEntry	1.3.6.1.4.1.11.2.14.11.5.1.19.1.17.1		not-accessible	Attributes of an authentication Redirect Server.
I32 hpicfUsrAuthRedirectServerIndex	1.3.6.1.4.1.11.2.14.11.5.1.19.1.17.1.1	Integer32	not-accessible	Index into hpicfUsrAuthRedirectServerTable.
OCT hpicfUsrAuthRedirectServerURL	1.3.6.1.4.1.11.2.14.11.5.1.19.1.17.1.2	OCTET STRING	read-create	This object represents the authentication Redirect Server's complete URL for the location of the redirect server login or warning page. This value must begin with 'http://' or 'https://' and should include the DNS name, TCP port of the server if not 80 or SSL's 443, and the page path, if necessary.
ROW hpicfUsrAuthRedirectServerRowStatus	1.3.6.1.4.1.11.2.14.11.5.1.19.1.17.1.3	RowStatus	read-create	This object indicates the status of this entry. Must NOT be active in order to modify some other column of this config entry.
INT hpicfUsrAuthRedirectServerRestrictiveFilter	1.3.6.1.4.1.11.2.14.11.5.1.19.1.18	INTEGER	read-write	If enabled, only the configured initial web page will be returned for all client requests. The enabled state would generally be used to simply display an informative warning message to failed macAuth clients. If disabled, all client/redirect-server http traffic will be permitted.
I32 hpicfUsrAuthRedirectServerClientTimeout	1.3.6.1.4.1.11.2.14.11.5.1.19.1.19	Integer32	read-write	The time (in seconds) that a client will be left in the unauthorized authentication redirection state before being removed from the state tables, temporarily suspending further client/redirect-server http traffic. After state table removal, client is free to initiate authentication.
C32 hpicfUsrAuthRedirectServerAuthFailureStatsEx	1.3.6.1.4.1.11.2.14.11.5.1.19.1.20	Counter32	read-only	The total number of times clients fail authentication and initiate the authentication Redirect Server process since reboot. A single client can be counted multiple times.
I32 hpicfUsrAuthCacheCredTimeOut	1.3.6.1.4.1.11.2.14.11.5.1.19.1.21	Integer32	read-write	Specifies the time in seconds, that the switch should remove the credentials. Reauthentication should take place with in small amount of time.
hpicfUsrAuthClientReauthenticateTable	1.3.6.1.4.1.11.2.14.11.5.1.19.1.22		not-accessible	A table containing configuration/control variables indexed by port and client MAC.
hpicfUsrAuthClientReauthenticateEntry	1.3.6.1.4.1.11.2.14.11.5.1.19.1.22.1		not-accessible	The table entry provides the means by which a client on an authentication interface can be forced to reauthenticate.
NUM hpicfUsrAuthClientReauthenticateInterfaceIndex	1.3.6.1.4.1.11.2.14.11.5.1.19.1.22.1.1	InterfaceIndex	not-accessible	Index of client interfaces.
MAC hpicfUsrAuthClientReauthenticateMacAddress	1.3.6.1.4.1.11.2.14.11.5.1.19.1.22.1.2	MacAddress	not-accessible	Specifies the MAC address of the client.
T/F hpicfUsrAuthClientReauthenticate	1.3.6.1.4.1.11.2.14.11.5.1.19.1.22.1.3	TruthValue	read-write	The reauthentication control for this client on this authentication interface. Setting this attribute TRUE forces this authenticated client to reauthenticate. That is, the client is deauthenticated and must transmit traffic in order to trigger reauthentication. Setting this attribute FALSE has no effect.
OCT hpicfUsrAuthMacAuthPassword	1.3.6.1.4.1.11.2.14.11.5.1.19.1.23	OCTET STRING	read-write	This object represents the secret password value used by all MAC auth clients. The default value of password is NULL. The password if set(non NULL) will be used instead of MAC address while constructing Radius request packet. The current maximum length of password is 16.
INT hpicfUsrAuthWebAuthAccessDeniedMode	1.3.6.1.4.1.11.2.14.11.5.1.19.1.24	INTEGER	read-write	Specifies the access denied mode that applies to the custom message embedded into the login failure page. The values: disabled (1) - the feature is disabled. custom (2) - use the string configured by administrator via CLI or SNMP. radius (3) - use the string in the 'reply-message' attribute of the received RADIUS response message.
OCT hpicfUsrAuthWebAuthAccessDeniedMessage	1.3.6.1.4.1.11.2.14.11.5.1.19.1.25	OCTET STRING	read-write	Text of the access denied message that will be embedded into the custom web auth login failure page. This message will only be used when the access denied mode is set to 'custom'. It can take up to 250 characters
C32 hpicfUsrAuthMacAuthUsrNumberCnt	1.3.6.1.4.1.11.2.14.11.5.1.19.1.26	Counter32	read-only	This object specifies the total number of authenticated clients currently present in the switch. This does not include the clients which are under process of authentication.
INT hpicfUsrAuthLastLoginNotifyStatus	1.3.6.1.4.1.11.2.14.11.5.1.19.1.27	INTEGER	accessible-for-notify	The status of the failed login attempt. successful(1) is not currently used. failed(2) indicates a regular failure that did not cause user lockout. failedLockOut(3) indicates a failure that caused user lockout. lockedOut(4) indicates that the user was locked out before the attempt was made. tableFull(5) indicates lockout due to a full lockout table, likely an indication of a serious attack.
IPt hpicfUsrAuthLastLoginNotifyAddrType	1.3.6.1.4.1.11.2.14.11.5.1.19.1.28	InetAddressType	accessible-for-notify	The type of IP address from which the user's most recent login attempt occurred. Unknown(0) indicates the console.
IP hpicfUsrAuthLastLoginNotifyAddr	1.3.6.1.4.1.11.2.14.11.5.1.19.1.29	InetAddress	accessible-for-notify	The IP address from which the user's most recent login attempt occurred.
T/F hpicfUsrAuthUseLLDPData	1.3.6.1.4.1.11.2.14.11.5.1.19.1.30	TruthValue	read-write	Enable or disable LLDP data inclusion in client authentication, which, in addition to using the source MAC address of incoming packets, also uses client information in the LLDP payload to authenticate clients.
OCT hpicfUsrAuthMacAuthPasswordEncrypted	1.3.6.1.4.1.11.2.14.11.5.1.19.1.31	OCTET STRING	read-write	This object represents the encrypted format of password value stored in the object hpicfUsrAuthMacAuthPassword. This object may only be read or written when hpSwitchAuthenticationEncryptCredentialsMethod is set to a value other than none(0). This object should only be written with an encrypted key.
hpicfUsrAuthPorts	1.3.6.1.4.1.11.2.14.11.5.1.19.2
hpicfUsrAuthPortTable	1.3.6.1.4.1.11.2.14.11.5.1.19.2.1		not-accessible	A table of system level information about Web- MAC-based authentication for each port in the switch.
hpicfUsrAuthPortEntry	1.3.6.1.4.1.11.2.14.11.5.1.19.2.1.1		not-accessible	The port number, operational mode and reauthentication control for each switch port.
NUM hpicfUsrAuthPortNumber	1.3.6.1.4.1.11.2.14.11.5.1.19.2.1.1.1	InterfaceIndex	accessible-for-notify	The port number associated with this switch port.
T/F hpicfUsrAuthWebAuthAdminStatus	1.3.6.1.4.1.11.2.14.11.5.1.19.2.1.1.2	TruthValue	read-write	Setting this attribute TRUE enables web-based authentication services. A value of FALSE disabled web-based authentication. This attribute cannot be set TRUE concurrently with hpicfUsrAuthMacAuthAdminStatus.
T/F hpicfUsrAuthMacAuthAdminStatus	1.3.6.1.4.1.11.2.14.11.5.1.19.2.1.1.3	TruthValue	read-write	Setting this attribute TRUE enables MAC-based authentication services. A value of FALSE disabled MAC-based authentication. This attribute cannot be set TRUE concurrently with hpicfUsrAuthWebAuthAdminStatus.
T/F hpicfUsrAuthPortReauthenticate	1.3.6.1.4.1.11.2.14.11.5.1.19.2.1.1.4	TruthValue	read-write	The reauthentication control for this port. Setting this attribute TRUE forces all authenticated clients to reauthenticate themselves. Setting this attribute FALSE has no effect. This attribute always returns FALSE when read.
T/F hpicfUsrAuthLMAAdminStatus	1.3.6.1.4.1.11.2.14.11.5.1.19.2.1.1.5	TruthValue	read-write	Setting this attribute TRUE enables Local MAC-based authentication services. A value of FALSE disabled MAC-based authentication. This attribute cannot be set TRUE concurrently with hpicfUsrAuthWebAuthAdminStatus.
T/F hpicfUsrAuthLLDPBypassAdminStatus	1.3.6.1.4.1.11.2.14.11.5.1.19.2.1.1.6	TruthValue	read-write	Setting this attribute as TRUE enables lldp-bypass authentication. A value of FALSE disables lldp-bypass authentication. This attribute cannot be set to TRUE concurrently with MAC lockdown, MACsec, Trunk, Distributed Trunking and mesh port features. The lldp-bypass feature is limited only for Aruba-APs that send special LLDP TLVs.
hpicfUsrAuthWebAuthConfig	1.3.6.1.4.1.11.2.14.11.5.1.19.3
hpicfUsrAuthWebAuthConfigTable	1.3.6.1.4.1.11.2.14.11.5.1.19.3.1		not-accessible	A table that contains the configuration objects for Web-based Authentication associated with each port. An entry appears in this table for each port that may authenticate access to itself.
hpicfUsrAuthWebAuthConfigEntry	1.3.6.1.4.1.11.2.14.11.5.1.19.3.1.1		not-accessible	The configuration information for Web-based authentication.
I32 hpicfUsrAuthWebAuthClientLimit	1.3.6.1.4.1.11.2.14.11.5.1.19.3.1.1.1	Integer32	read-write	The maximum number of authenticated clients to allow on the port.
INT hpicfUsrAuthWebAuthClientMoves	1.3.6.1.4.1.11.2.14.11.5.1.19.3.1.1.2	INTEGER	read-write	Specifies whether client may roam across ports under web authentication control. Setting this attribute 'enabled'allows authenticated clients to roam to other ports under web authentication control (that also have this attribute set to 'enabled') without requiring a reauthentication. Setting this attribute 'disabled' disallows authenticated clients from roaming to other ports (regardless of that port's attribute value). The client has to reauthenticate, if it attempts to roam.
INT hpicfUsrAuthWebAuthSSLState	1.3.6.1.4.1.11.2.14.11.5.1.19.3.1.1.3	INTEGER	read-write	Specifies whether web-based authentication should use an SSL connection (i.e. https://) to switch to collect client credentials. Note: A valid certificate must be configured on switch before SSL connections are enabled.
OCT hpicfUsrAuthWebAuthRedirectUrl	1.3.6.1.4.1.11.2.14.11.5.1.19.3.1.1.4	OCTET STRING	read-write	Specifies the URL, to which an authenticated client should be redirected, after successful authentication.
I32 hpicfUsrAuthWebAuthQuietPeriod	1.3.6.1.4.1.11.2.14.11.5.1.19.3.1.1.5	Integer32	read-write	Specifies the time, in seconds, that the switch should refrain from reattempting an authentication request for a client whose credentials were rejected.
I32 hpicfUsrAuthWebAuthServerTimeout	1.3.6.1.4.1.11.2.14.11.5.1.19.3.1.1.6	Integer32	read-write	Specifies the time, in seconds, that the switch should wait for an authentication reply to return before considering it as timed out.
I32 hpicfUsrAuthWebAuthServerMaxReq	1.3.6.1.4.1.11.2.14.11.5.1.19.3.1.1.7	Integer32	read-write	Specifies the number of authentication requests that must time out before failing authentication.
I32 hpicfUsrAuthWebAuthMaxRetries	1.3.6.1.4.1.11.2.14.11.5.1.19.3.1.1.8	Integer32	read-write	Specifies the number of authentication requests that must fail (i.e. invalid credentials) before failing authentication.
I32 hpicfUsrAuthWebAuthLogoffPeriod	1.3.6.1.4.1.11.2.14.11.5.1.19.3.1.1.9	Integer32	read-write	Specifies the period, in seconds, at which an authenticated client will be considered unauthenticated for a lack of activity (i.e. traffic originating from client).
I32 hpicfUsrAuthWebAuthReAuthPeriod	1.3.6.1.4.1.11.2.14.11.5.1.19.3.1.1.10	Integer32	read-write	Specifies the period, in seconds, at which an authenticated client must reauthenticate. A value of 0 signifies that an authenticated client will never have to reauthenticate. When hpSwitchAutzUserRoleEnabled is true, this value will be superseded by the value of hpSwitchAutzUserRoleReauthPeriod from the client's assigned role.
VLA hpicfUsrAuthWebAuthAuthVid	1.3.6.1.4.1.11.2.14.11.5.1.19.3.1.1.11	VlanIndex	read-write	Specifies the port VID (PVID) that should be used for an authenticated client. When hpSwitchAutzUserRoleEnabled is true, this value may be superseded by the value of hpSwitchAutzUserRoleVlanId or hpSwitchAutzUserRoleVlanName from the client's assigned role.
VLA hpicfUsrAuthWebAuthUnauthVid	1.3.6.1.4.1.11.2.14.11.5.1.19.3.1.1.12	VlanIndex	read-write	Specifies the port VID (PVID) that should be used for an unauthenticated client. When hpSwitchAutzUserRoleEnabled is true, this value may be superseded by the value of hpSwitchAutzUserRoleVlanId or hpSwitchAutzUserRoleVlanName from the role identified by hpSwitchAutzUserRoleInitialRoleName.
INT hpicfUsrAuthWebAuthCacheCredentials	1.3.6.1.4.1.11.2.14.11.5.1.19.3.1.1.13	INTEGER	read-write	Specifies whether to cache client credentials or not. Setting this variable 'enabled' allows to cache authenticated clients credentials. Setting this variable 'disabled' disallows to cache authenticated clients credentials.
U32 hpicfUsrAuthWebAuthCachedReauthPeriod	1.3.6.1.4.1.11.2.14.11.5.1.19.3.1.1.14	Unsigned32	read-write	The value indicates the period in seconds, during which cached reauthentication is allowed on the port. If value is zero then the period of cached reauthentication is unlimited.
hpicfUsrAuthWebAuthClientReauthenticateTable	1.3.6.1.4.1.11.2.14.11.5.1.19.3.2		not-accessible	A table containing WebAuth configuration/control variables indexed by port and client MAC.
hpicfUsrAuthWebAuthClientReauthenticateEntry	1.3.6.1.4.1.11.2.14.11.5.1.19.3.2.1		not-accessible	The table entry provides the means by which a WebAuth client on an authentication interface can be forced to reauthenticate.
NUM hpicfUsrAuthWebAuthClientReauthenticateInterfaceIndex	1.3.6.1.4.1.11.2.14.11.5.1.19.3.2.1.1	InterfaceIndex	not-accessible	Index of WebAuth client interfaces.
MAC hpicfUsrAuthWebAuthClientReauthenticateMacAddress	1.3.6.1.4.1.11.2.14.11.5.1.19.3.2.1.2	MacAddress	not-accessible	Specifies the MAC address of the client.
T/F hpicfUsrAuthWebAuthClientReauthenticate	1.3.6.1.4.1.11.2.14.11.5.1.19.3.2.1.3	TruthValue	read-write	The reauthentication control for this client on this authentication interface. Setting this attribute TRUE forces this authenticated WebAuth client to reauthenticate. That is, the client is deauthenticated and must transmit traffic in order to trigger reauthentication. Setting this attribute FALSE has no effect.
hpicfUsrAuthMacAuthConfig	1.3.6.1.4.1.11.2.14.11.5.1.19.4
hpicfUsrAuthMacAuthConfigTable	1.3.6.1.4.1.11.2.14.11.5.1.19.4.1		not-accessible	A table that contains the configuration objects for Mac-based Authentication associated with each port. An entry appears in this table for each port that may authenticate access to itself.
hpicfUsrAuthMacAuthConfigEntry	1.3.6.1.4.1.11.2.14.11.5.1.19.4.1.1		not-accessible	The configuration information for Mac-based authentication.
I32 hpicfUsrAuthMacAuthClientLimit	1.3.6.1.4.1.11.2.14.11.5.1.19.4.1.1.1	Integer32	read-write	The maximum number of authenticated clients to allow on the port.
INT hpicfUsrAuthMacAuthClientMoves	1.3.6.1.4.1.11.2.14.11.5.1.19.4.1.1.2	INTEGER	read-write	Specifies whether client may roam across ports under web authentication control. Setting this attribute 'enabled'allows authenticated clients to roam to other ports under web authentication control (that also have this attribute set to 'enabled') without requiring a reauthentication. Setting this attribute 'disabled' disallows authenticated clients from roaming to other ports (regardless of that port's attribute value). The client has to reauthenticate, if it attempts to roam.
I32 hpicfUsrAuthMacAuthQuietPeriod	1.3.6.1.4.1.11.2.14.11.5.1.19.4.1.1.3	Integer32	read-write	Specifies the time, in seconds, that the switch should refrain from reattempting an authentication request for a client whose credentials were rejected.
I32 hpicfUsrAuthMacAuthServerTimeout	1.3.6.1.4.1.11.2.14.11.5.1.19.4.1.1.4	Integer32	read-write	Specifies the time, in seconds, that the switch should wait for an authentication reply to return before considering it as timed out.
I32 hpicfUsrAuthMacAuthServerMaxReq	1.3.6.1.4.1.11.2.14.11.5.1.19.4.1.1.5	Integer32	read-write	Specifies the number of authentication requests that must time out before failing authentication.
I32 hpicfUsrAuthMacAuthLogoffPeriod	1.3.6.1.4.1.11.2.14.11.5.1.19.4.1.1.6	Integer32	read-write	Specifies the period, in seconds, at which an authenticated client will be considered unauthenticated for a lack of activity (i.e. traffic originating from client).
I32 hpicfUsrAuthMacAuthReAuthPeriod	1.3.6.1.4.1.11.2.14.11.5.1.19.4.1.1.7	Integer32	read-write	Specifies the period, in seconds, at which an authenticated client must reauthenticate. A value of 0 signifies that an authenticated client will never have to reauthenticate. When hpSwitchAutzUserRoleEnabled is true, this value will be superseded by the value of hpSwitchAutzUserRoleReauthPeriod from the client's assigned role.
VLA hpicfUsrAuthMacAuthAuthVid	1.3.6.1.4.1.11.2.14.11.5.1.19.4.1.1.8	VlanIndex	read-write	Specifies the port VID (PVID) that should be used for an authenticated client. When hpSwitchAutzUserRoleEnabled is true, this value may be superseded by the value of hpSwitchAutzUserRoleVlanId or hpSwitchAutzUserRoleVlanName from the client's assigned role.
VLA hpicfUsrAuthMacAuthUnauthVid	1.3.6.1.4.1.11.2.14.11.5.1.19.4.1.1.9	VlanIndex	read-write	Specifies the port VID (PVID) that should be used for an unauthenticated client. When hpSwitchAutzUserRoleEnabled is true, this value may be superseded by the value of hpSwitchAutzUserRoleVlanId or hpSwitchAutzUserRoleVlanName from the role identified by hpSwitchAutzUserRoleInitialRoleName.
U32 hpicfUsrAuthMacAuthCachedReauthPeriod	1.3.6.1.4.1.11.2.14.11.5.1.19.4.1.1.10	Unsigned32	read-write	The value indicates the period in seconds, during which cached reauthentication is allowed on the port. If value is zero then the period of cached reauthentication is unlimited.
I32 hpicfUsrAuthMacAuthUnAuthPeriod	1.3.6.1.4.1.11.2.14.11.5.1.19.4.1.1.11	Integer32	read-write	Specifies the period, in seconds, at which an authenticated client must reauthenticate. A value of 0 signifies that an authenticated client will never have to reauthenticate.
INT hpicfUsrAuthMacAuthMode	1.3.6.1.4.1.11.2.14.11.5.1.19.4.1.1.12	INTEGER	read-only	This object provides information about the authentication mode of a specific port performing MAC authentication. In 'userBased' mode, the port performing MAC authentication will authenticate every client coming in the port; the port will change into 'portBased' mode when a client is authenticated on the port and is authorized to open its connecting switch port to all other clients (i.e., its client account on the RADIUS server is configured with VSA 'HP-Port-Auth-Mode-MA'). A port in portBased MAC authentication mode will grant access for any client coming in the port.
T/F hpicfUsrAuthMacPin	1.3.6.1.4.1.11.2.14.11.5.1.19.4.1.1.13	TruthValue	read-write	Enables MAC-Pinning on this port. Setting this attribute TRUE pins the authenticated MAC addresses to the Mac address table. Authenticated clients will not be de-authenticated even when clients are inactive throughout the logoff period.
T/F hpicfMacAuthRetainUnauthClients	1.3.6.1.4.1.11.2.14.11.5.1.19.4.1.1.14	TruthValue	read-write	Setting this attribute TRUE(1) allows access to Mac-based unauthorized clients by placing the port in unauthorized VLAN during reauthentication.
hpicfUsrAuthMacAuthClientReauthenticateTable	1.3.6.1.4.1.11.2.14.11.5.1.19.4.2		not-accessible	A table containing macAuth configuration/control variables indexed by port and client MAC.
hpicfUsrAuthMacAuthClientReauthenticateEntry	1.3.6.1.4.1.11.2.14.11.5.1.19.4.2.1		not-accessible	The table entry provides the means by which a macAuth client on an authentication interface can be forced to reauthenticate.
NUM hpicfUsrAuthMacAuthClientReauthenticateInterfaceIndex	1.3.6.1.4.1.11.2.14.11.5.1.19.4.2.1.1	InterfaceIndex	not-accessible	Index of macAuth client interfaces.
MAC hpicfUsrAuthMacAuthClientReauthenticateMacAddress	1.3.6.1.4.1.11.2.14.11.5.1.19.4.2.1.2	MacAddress	not-accessible	Specifies the MAC address of the client.
T/F hpicfUsrAuthMacAuthClientReauthenticate	1.3.6.1.4.1.11.2.14.11.5.1.19.4.2.1.3	TruthValue	read-write	The reauthentication control for this client on this authentication interface. Setting this attribute TRUE forces this authenticated macAuth client to reauthenticate. That is, the client is deauthenticated and must transmit traffic in order to trigger reauthentication. Setting this attribute FALSE has no effect.
hpicfUsrAuthWebAuthStats	1.3.6.1.4.1.11.2.14.11.5.1.19.5
hpicfUsrAuthWebAuthSessionStatsTable	1.3.6.1.4.1.11.2.14.11.5.1.19.5.1		not-accessible	A table that contains session statistic objects for each client (i.e. user) attempting to authenticate to a port with Web-authentication enabled. An entry appears in this table for each port in the switch.
hpicfUsrAuthWebAuthSessionStatsEntry	1.3.6.1.4.1.11.2.14.11.5.1.19.5.1.1		not-accessible	The session statistics information for a port with Web-based authentication enabled. This shows the current values being collected for active sessions.
MAC hpicfUsrAuthWebAuthSessionMacAddr	1.3.6.1.4.1.11.2.14.11.5.1.19.5.1.1.1	MacAddress	read-only	Specifies the MAC address of the client.
STR hpicfUsrAuthWebAuthSessionName	1.3.6.1.4.1.11.2.14.11.5.1.19.5.1.1.2	SnmpAdminString	read-only	Specifies the username of the client.
INT hpicfUsrAuthWebAuthSessionState	1.3.6.1.4.1.11.2.14.11.5.1.19.5.1.1.3	INTEGER	read-only	Specifies the state of the client as follows: 'authenticated' - authenticated client 'unauthenticated' - unauthenticated client, waiting for credentials 'authenticating' - credentials have been sent for verification, waiting for response 'authReqRejectNoVlan' - credentials invalid; client does not have access to unauthenticated VLAN 'authReqRejectUnauthVlan' - credentials invalid; client does have access to unauthenticated VLAN 'authReqTimeoutNoVlan' - credentials could not be verified; client is still unauthenticated and does not have access to unauthenticated VLAN 'authReqTimeoutUnauthVlan' - credentials could not be verified; client is still unauthenticated, but has access to unauthenticated VLAN 'initialRole' - client is assigned the initial role 'initialRoleFailed' - initial role could not be applied; client does not have access to the network 'criticalAuth - client is authenticated on critical VLAN 'openAUth - client is authenticated on open auth VLAN
U32 hpicfUsrAuthWebAuthSessionStateTime	1.3.6.1.4.1.11.2.14.11.5.1.19.5.1.1.4	Unsigned32	read-only	The duration, in seconds, a client has spent in the state specified by hpicfUsrAuthSessionState.
VLA hpicfUsrAuthWebAuthSessionAuthVid	1.3.6.1.4.1.11.2.14.11.5.1.19.5.1.1.5	VlanIndex	read-only	Specifies the PVID that the authenticated client is utilizing. If client is unauthenticated, this object has no meaning.
VLA hpicfUsrAuthWebAuthSessionUnauthVid	1.3.6.1.4.1.11.2.14.11.5.1.19.5.1.1.6	VlanIndex	read-only	Specifies the PVID that the unauthenticated client is utilizing. If client is authenticated, this object has no meaning.
U32 hpicfUsrAuthWebAuthSessionTimeout	1.3.6.1.4.1.11.2.14.11.5.1.19.5.1.1.7	Unsigned32	read-only	Specifies the RADIUS Server set session timeout for reauthentication of the user. When ST = 0, user gets reauthenticated at reauth-period secs, ST 60 user is reauthenticated at ST secs.
HPA hpicfUsrAuthWebAuthSessionRole	1.3.6.1.4.1.11.2.14.11.5.1.19.5.1.1.8	HpAutzUserRoleName	read-only	When hpSwitchAutzUserRoleEnabled is true, specifies the user role of the client.
hpicfUsrAuthMacAuthStats	1.3.6.1.4.1.11.2.14.11.5.1.19.6
hpicfUsrAuthMacAuthSessionStatsTable	1.3.6.1.4.1.11.2.14.11.5.1.19.6.1		not-accessible	A table that contains session statistic objects for each client (i.e. user) attempting to authenticate to a port with MAC-authentication enabled. An entry appears in this table for each port in the switch.
hpicfUsrAuthMacAuthSessionStatsEntry	1.3.6.1.4.1.11.2.14.11.5.1.19.6.1.1		not-accessible	The session statistics information for a port with Mac-based authentication enabled. This shows the current values being collected for active sessions.
MAC hpicfUsrAuthMacAuthSessionMacAddr	1.3.6.1.4.1.11.2.14.11.5.1.19.6.1.1.1	MacAddress	read-only	Specifies the MAC address of the client.
INT hpicfUsrAuthMacAuthSessionState	1.3.6.1.4.1.11.2.14.11.5.1.19.6.1.1.2	INTEGER	read-only	Specifies the state of the client as follows: 'authenticated' - authenticated client 'unauthenticated' - unauthenticated client, waiting for credentials 'authenticating' - credentials have been sent for verification, waiting for response 'authReqRejectNoVlan' - credentials invalid; client does not have access to unauthenticated VLAN 'authReqRejectUnauthVlan - credentials invalid; client does have access to unauthenticated VLAN 'authReqTimeoutNoVlan' - credentials could not be verified; client is still unauthenticated and does not have access to unauthenticated VLAN 'authReqTimeoutUnauthVlan' - credentials could not be verified; client is still unauthenticated, but has access to unauthenticated VLAN 'initialRole' - client is assigned the initial role 'initialRoleFailed' - initial role could not be applied; client does not have access to the network 'criticalAuth - client is authenticated on critical VLAN 'openAUth - client is authenticated on open auth VLAN
U32 hpicfUsrAuthMacAuthSessionStateTime	1.3.6.1.4.1.11.2.14.11.5.1.19.6.1.1.3	Unsigned32	read-only	The duration, in seconds, a client has spent in the state specified by hpicfUsrAuthSessionState.
VLA hpicfUsrAuthMacAuthSessionAuthVid	1.3.6.1.4.1.11.2.14.11.5.1.19.6.1.1.4	VlanIndex	read-only	Specifies the PVID that the authenticated client is utilizing. If client is unauthenticated, this object has no meaning.
VLA hpicfUsrAuthMacAuthSessionUnauthVid	1.3.6.1.4.1.11.2.14.11.5.1.19.6.1.1.5	VlanIndex	read-only	Specifies the PVID that the unauthenticated client is utilizing. If client is authenticated, this object has no meaning.
U32 hpicfUsrAuthMacAuthSessionTimeout	1.3.6.1.4.1.11.2.14.11.5.1.19.6.1.1.6	Unsigned32	read-only	Specifies the RADIUS Server set session timeout for reauthentication of the user. When ST = 0, user gets reauthenticated at reauth-period secs, ST 60 user is reauthenticated at ST secs.
C32 hpicfUsrAuthMacAuthSessionUsrNumberCnt	1.3.6.1.4.1.11.2.14.11.5.1.19.6.1.1.7	Counter32	read-only	This object Specifies the number of authenticated client currently present on this port. This does not include the clients which are under process of authentication.
STR hpicfUsrAuthMacAuthSessionName	1.3.6.1.4.1.11.2.14.11.5.1.19.6.1.1.8	SnmpAdminString	read-only	Specifies the username of the client.
HPA hpicfUsrAuthMacAuthSessionRole	1.3.6.1.4.1.11.2.14.11.5.1.19.6.1.1.9	HpAutzUserRoleName	read-only	When hpSwitchAutzUserRoleEnabled is true, specifies the user role of the client.
hpicfUsrAuthConformance	1.3.6.1.4.1.11.2.14.11.5.1.19.7
hpicfUsrAuthGroups	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2
hpicfUsrAuthSystemGroup	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2.1			A collection of objects providing system information about, and control over, Web- and MAC-based authentication.
hpicfUsrAuthPortsGroup	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2.2			A collection of objects providing system level information about Web and MAC based authentication for each port in the switch.
hpicfUsrAuthWebAuthConfigGroup	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2.3			A collection of objects providing configuration objects for Web-based authentication associated with each port.
hpicfUsrAuthMacAuthConfigGroup	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2.4			A collection of objects providing configuration objects for MAC-based authentication associated with each port.
hpicfUsrAuthWebAuthSessionStatsGroup	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2.5			A collection of objects providing statistics about current sessions for Web-based authentication.
hpicfUsrAuthMacAuthSessionStatsGroup	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2.6			A collection of objects providing statistics about current sessions for MAC-based authentication.
hpicfUsrAuthWebAuthConfigGroup1	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2.7			A collection of objects providing configuration objects for Web-based authentication associated with each port.
hpicfUsrAuthMacAuthConfigGroup1	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2.8			A collection of objects providing configuration objects for MAC-based authentication associated with each port.
hpicfUsrAuthMacAuthConfigGroup2	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2.9			A collection of objects providing configuration objects for MAC-based authentication associated with each port.
hpicfUsrAuthRedirectServerGroup	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2.10			A collection of objects for authentication Redirect Server.
hpicfUsrAuthWMAeWAServerGroup	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2.11			A collection of objects for Enhanced Web Auth servers.
hpicfUsrAuthClientReauthenticateGroup	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2.12			A collection of objects for Reauthentication settings .
hpicfUsrAuthMacAuthSessionStatsGroup1	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2.13			A collection of objects providing RADIUS server set session timeout for MAC-based user reauthentication.
hpicfUsrAuthWebAuthSessionStatsGroup1	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2.14			A collection of objects providing RADIUS server set session timeout for Web-based user reauthentication.
hpicfUsrAuthLastLoginGroup	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2.15			A collection of objects for viewing the most recent logins to the switch by users, and for deleting the table.
hpicfUsrAuthPortsGroup1	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2.16			A collection of objects providing system level information about Web and MAC based authentication for each port in the switch.
hpicfUsrAuthCaptivePortalGroup	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2.17			A collection of objects providing configuration for the captive portal feature.
hpicfUsrAuthCaptivePortalProfileGroup	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2.18			A collection of objects providing configuration for captive portal profiles.
hpicfUsrAuthWebAuthSessionStatsGroup2	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2.19			A collection of objects providing statistics about current sessions for Web-based authentication.
hpicfUsrAuthMacAuthSessionStatsGroup2	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2.20			A collection of objects providing statistics about current sessions for MAC-based authentication.
hpicfUsrAuthPortsGroup2	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2.21			A collection of objects providing system level information about Web and MAC based authentication for each port in the switch.
hpicfUsrAuthMacAuthConfigGroup3	1.3.6.1.4.1.11.2.14.11.5.1.19.7.2.22			A collection of objects providing configuration objects for MAC-based authentication associated with each port.
hpicfUsrAuthCompliances	1.3.6.1.4.1.11.2.14.11.5.1.19.7.4
hpicfUsrAuthCompliance	1.3.6.1.4.1.11.2.14.11.5.1.19.7.4.1			******* THIS COMPLIANCE IS DEPRECATED ******* The compliance statement for devices support of HP-USER-AUTH MIB.
hpicfUsrAuthCompliance1	1.3.6.1.4.1.11.2.14.11.5.1.19.7.4.2			The compliance statement for devices support of HP-USER-AUTH MIB.
hpicfUsrAuthCompliance2	1.3.6.1.4.1.11.2.14.11.5.1.19.7.4.3			The compliance statement for devices support of HP-USER-AUTH MIB.
hpicfUsrAuthCompliance3	1.3.6.1.4.1.11.2.14.11.5.1.19.7.4.4			The compliance statement for devices support of HP-USER-AUTH MIB.
hpicfUsrAuthCompliance4	1.3.6.1.4.1.11.2.14.11.5.1.19.7.4.5			The compliance statement for devices support of HP-USER-AUTH MIB.
hpicfUsrAuthCompliance5	1.3.6.1.4.1.11.2.14.11.5.1.19.7.4.6			The compliance statement for devices support of HP-USER-AUTH MIB.
hpicfUsrAuthCompliance6	1.3.6.1.4.1.11.2.14.11.5.1.19.7.4.7			The compliance statement for devices support of HP-USER-AUTH MIB.
hpicfUsrAuthCompliance7	1.3.6.1.4.1.11.2.14.11.5.1.19.7.4.8			The compliance statement for device support of HP-USER-AUTH MIB.
hpicfUsrAuthCompliance8	1.3.6.1.4.1.11.2.14.11.5.1.19.7.4.9			The compliance statement for device support of HP-USER-AUTH MIB.
hpicfUsrAuthCompliance9	1.3.6.1.4.1.11.2.14.11.5.1.19.7.4.10			The compliance statement for device support of HP-USER-AUTH MIB.
hpicfUsrAuthCompliance10	1.3.6.1.4.1.11.2.14.11.5.1.19.7.4.11			The compliance statement for device support of HP-USER-AUTH MIB.
hpicfUsrAuthCompliance11	1.3.6.1.4.1.11.2.14.11.5.1.19.7.4.12			The compliance statement for devices support of HP-USER-AUTH MIB.
hpicfUsrAuthCompliance12	1.3.6.1.4.1.11.2.14.11.5.1.19.7.4.13			The compliance statement for devices support of HP-USER-AUTH MIB.
hpicfUsrAuthCompliance13	1.3.6.1.4.1.11.2.14.11.5.1.19.7.4.14			The compliance statement for devices support of HP-USER-AUTH MIB.
hpicfUsrAuthCompliance14	1.3.6.1.4.1.11.2.14.11.5.1.19.7.4.15			The compliance statement for device support of HP-USER-AUTH MIB.
hpicfUsrAuthCompliance15	1.3.6.1.4.1.11.2.14.11.5.1.19.7.4.16			The compliance statement for devices support of HP-USER-AUTH MIB.
hpicfUsrAuthCompliance16	1.3.6.1.4.1.11.2.14.11.5.1.19.7.4.17			The compliance statement for device support of HP-USER-AUTH MIB.
hpicfUsrAuthNotifyConformance	1.3.6.1.4.1.11.2.14.11.5.1.19.8
hpicfUsrAuthNotificationGroup	1.3.6.1.4.1.11.2.14.11.5.1.19.8.1			A group of authorization notifications.
hpicfNotifcationConfigDataGroup	1.3.6.1.4.1.11.2.14.11.5.1.19.8.2			A group of notification data and configuration objects.
hpicfNotificationConfigDataGroup1	1.3.6.1.4.1.11.2.14.11.5.1.19.8.3			A group of notification data and configuration objects.
hpicfUsrAuthMacGlobalConformance	1.3.6.1.4.1.11.2.14.11.5.1.19.9
hpicfUsrAuthMacGroup	1.3.6.1.4.1.11.2.14.11.5.1.19.9.1			A group of Mac auth global configuration objects.
hpicfUsrAuthMacGroup1	1.3.6.1.4.1.11.2.14.11.5.1.19.9.2			A group of Mac auth global configuration objects.
hpicfUsrAuthWebAuthAccessDeniedConformance	1.3.6.1.4.1.11.2.14.11.5.1.19.10
hpicfUsrAuthWebAuthAccessDeniedGroup	1.3.6.1.4.1.11.2.14.11.5.1.19.10.1			A group of web-auth access denied configuration objects.
hpicfUsrAuthMacAuthUsrNumberConformance	1.3.6.1.4.1.11.2.14.11.5.1.19.11
hpicfUsrAuthMacAuthUsrNumberGroup	1.3.6.1.4.1.11.2.14.11.5.1.19.11.1			Number of Mac authenticated client objects in the switch and port.
hpicfUsrAuthLastLogin	1.3.6.1.4.1.11.2.14.11.5.1.19.12
U32 hpicfUsrAuthLastLoginCurrentGeneration	1.3.6.1.4.1.11.2.14.11.5.1.19.12.1	Unsigned32	read-only	The current generation number of the rows in hpicfUsrAuthLastLoginTable. To obtain a consistent table view, first read this object, then enumerate the table (reading hpicfUsrAuthLastLoginGeneration last), discarding any rows with hpicfUsrAuthLastLoginGeneration greater than this value.
hpicfUsrAuthLastLoginTable	1.3.6.1.4.1.11.2.14.11.5.1.19.12.2		not-accessible	This table records, per-username, the most recent login and login attempts. A record is created by the switch upon the first successful login to a username, and updated upon each subsequent login or login attempt.
hpicfUsrAuthLastLoginEntry	1.3.6.1.4.1.11.2.14.11.5.1.19.12.2.1		not-accessible	User last login table entry.
U32 hpicfUsrAuthLastLoginIndex	1.3.6.1.4.1.11.2.14.11.5.1.19.12.2.1.1	Unsigned32	not-accessible	The index value which uniquely identifies a row in the user last-login table.
STR hpicfUsrAuthLastLoginName	1.3.6.1.4.1.11.2.14.11.5.1.19.12.2.1.2	DisplayString	read-only	The user's login name.
INT hpicfUsrAuthLastLoginPrivilege	1.3.6.1.4.1.11.2.14.11.5.1.19.12.2.1.3	INTEGER	read-only	The privilege level assigned to the user at the most recent login.
DAT hpicfUsrAuthLastLoginSuccTime	1.3.6.1.4.1.11.2.14.11.5.1.19.12.2.1.4	DateAndTime	read-only	The time of the user's most recent successful login.
IPt hpicfUsrAuthLastLoginSuccAddrType	1.3.6.1.4.1.11.2.14.11.5.1.19.12.2.1.5	InetAddressType	read-only	The type of IP address from which the user's most recent successful login occurred. Unknown(0) indicates a console login.
IP hpicfUsrAuthLastLoginSuccAddr	1.3.6.1.4.1.11.2.14.11.5.1.19.12.2.1.6	InetAddress	read-only	The IP address from which the user's most recent successful login occurred.
DAT hpicfUsrAuthLastLoginUnsuccTime	1.3.6.1.4.1.11.2.14.11.5.1.19.12.2.1.7	DateAndTime	read-only	The time of the user's most recent unsuccessful login attempt. This will be zero length if there have been no unsuccessful login attempts since the most recent successful login.
C32 hpicfUsrAuthLastLoginUnsuccCount	1.3.6.1.4.1.11.2.14.11.5.1.19.12.2.1.8	Counter32	read-only	The count of the user's unsuccessful login attempts since the most recent successful login. This counter is reset to zero whenever hpicfUsrAuthLastLoginSuccTime changes.
U32 hpicfUsrAuthLastLoginGeneration	1.3.6.1.4.1.11.2.14.11.5.1.19.12.2.1.9	Unsigned32	read-only	The generation number of the objects in this row. This object should be tested after reading other objects in a row to ensure it has not changed from hpicfUsrAuthLastLoginCurrentGeneration, or from the value of hpicfUsrAuthLastLoginGeneration sent in an hpicfUsrAuthCLIAuthFail notification.
T/F hpicfUsrAuthLastLoginDeleteAll	1.3.6.1.4.1.11.2.14.11.5.1.19.12.3	TruthValue	read-write	When set to true(1), all rows of the last-login table are deleted. Always reads as false(2).
hpicfUsrAuthCaptivePortal	1.3.6.1.4.1.11.2.14.11.5.1.19.13
hpicfUsrAuthCaptivePortalConfig	1.3.6.1.4.1.11.2.14.11.5.1.19.13.1
T/F hpicfUsrAuthCaptivePortalConfigEnabled	1.3.6.1.4.1.11.2.14.11.5.1.19.13.1.1	TruthValue	read-write	Enable redirection to a captive portal server for additional client authentication. When enabled, clients will be redirected to a captive portal server for further authentication when the RADIUS response includes a redirect URL.
OCT hpicfUsrAuthCaptivePortalUrlHashKey	1.3.6.1.4.1.11.2.14.11.5.1.19.13.1.2	OCTET STRING	read-write	A shared secret used by the captive portal server to validate a redirected request. A read of this object always returns an empty string.
OCT hpicfUsrAuthCaptivePortalUrlHashKeyEncrypted	1.3.6.1.4.1.11.2.14.11.5.1.19.13.1.3	OCTET STRING	read-write	The encrypted form of the shared secret used by the captive portal server to validate a redirected request. This object should only be written with an encrypted password previously read from a compatible HP Networking device.
hpicfUsrAuthCaptivePortalProfileTable	1.3.6.1.4.1.11.2.14.11.5.1.19.13.2		not-accessible	This table consists of the captive portal profiles configured on the switch. The size of this table is implementation specific.
hpicfUsrAuthCaptivePortalProfileEntry	1.3.6.1.4.1.11.2.14.11.5.1.19.13.2.1		not-accessible	A captive portal profile table entry.
OCT hpicfUsrAuthCaptivePortalProfileName	1.3.6.1.4.1.11.2.14.11.5.1.19.13.2.1.1	OCTET STRING	not-accessible	The name of this profile. All printable ASCII characters are allowed except '.', ' ', and '~'.
ROW hpicfUsrAuthCaptivePortalProfileRowStatus	1.3.6.1.4.1.11.2.14.11.5.1.19.13.2.1.2	RowStatus	read-create	The Row Status of this entry. To create a new entry, send an SNMP SET request with a RowStatus of 'createAndGo'. active - the entry is ready to use. notInService - not valid for this table. notReady - the entry is not fully configured. createAndGo - create a new entry. createAndWait - not valid for this table. delete - delete the entry. Entries of hpicfUsrAuthCaptivePortalProfileType 'predefined' cannot be deleted.
INT hpicfUsrAuthCaptivePortalProfileType	1.3.6.1.4.1.11.2.14.11.5.1.19.13.2.1.3	INTEGER	read-only	Indicates whether the corresponding profile is predefined or custom. Predefined profiles cannot be modified or deleted.
OCT hpicfUsrAuthCaptivePortalProfileRedirectUrl	1.3.6.1.4.1.11.2.14.11.5.1.19.13.2.1.4	OCTET STRING	read-create	The URL of the captive portal the user is redirected to for authentication. An empty value indicates the URL will be sent via the RADIUS VSA: HPE-CAPTIVE-PORTAL-URL(24)

RFC description

User authentication MIB for HP/HPE switches, managing WebAuth, MAC authentication, and CLI password-based user access control.

Start monitoring HP/Aruba networking switch or wireless access point (WebAuth/MacAuth/CLI auth) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HP-USER-AUTH