All MIBs › IPS-AUTH-MIB
Organization: IETF IPS Working Group
Last Updated: 2006-05-22
Category: Fibre Channel and Storage, Hardware and Environment
Description: Defines managed objects for managing user identity authorization in IP storage environments.
IPNetwork Monitor uses several OIDs from this MIB in network discovery and polling the applicable devices. Start monitoring IPS-AUTH-MIB with a free 30-day trial of IPNetwork Monitor.
What Is IPS-AUTH-MIB?
IPS-AUTH-MIB, standardized as RFC 4545, is a vendor-neutral IETF MIB defining managed objects for authorization and identity management within IP storage (iSCSI/iFCP/FCIP) environments. It exposes tables of authorization instances and identities, including per-identity descriptions, storage type, and row status for provisioning entries, alongside notification and conformance groups. Its monitoring value is primarily configuration/software status: administrators can verify which authorization identities and instances are provisioned and active (via row status) on an IP storage gateway or target, rather than hardware health. As an IETF standards-track MIB it is explicitly built on RFC 4545 and complements the broader IETF IP storage MIB suite (e.g., iSCSI and FCIP MIBs) for the same devices. It is deployed on IP storage networking equipment such as iSCSI/FCIP gateways and storage routers to manage access control configuration. Engineers implementing or auditing this functionality typically reference the IPS-AUTH-MIB RFC/standard documentation for the authoritative specification.
IPNetwork Monitor allows you to monitor SNMP objects defined in IPS-AUTH-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- vendor-neutral, standards-based MIB, not tied to a specific manufacturer
- IP storage (iSCSI/FCIP) gateway or storage router
Monitoring Examples
An administrator would poll ipsAuthInstanceAttributesTable entries like ipsAuthInstDescr to identify configured authorization instances, and check ipsAuthIdentAttributesTable objects such as ipsAuthIdentDescription and ipsAuthIdentRowStatus to confirm a given identity entry is active rather than notReady or notInService. The ipsAuthNotifications group would be used to alert on changes to these authorization entries, helping catch unauthorized or unexpected identity provisioning.
What Can Be Monitored
- authorization instance configuration
- identity entry row status
- identity description/name attributes
- storage type of auth entries
This MIB depends on
Related MIBs
Imported Objects
From IANA-ADDRESS-FAMILY-NUMBERS-MIB
| AddressFamilyNumbers |
From SNMP-FRAMEWORK-MIB
| SnmpAdminString |
From SNMPv2-CONF
| MODULE-COMPLIANCE | |
| OBJECT-GROUP |
From SNMPv2-SMI
| MODULE-IDENTITY | |
| OBJECT-IDENTITY | |
| OBJECT-TYPE | |
| Unsigned32 | |
| mib-2 |
From SNMPv2-TC
| AutonomousType | |
| RowStatus | |
| StorageType | |
| TEXTUAL-CONVENTION |
OIDs
| OID symbolic | OID numeric | Type | Access | Description |
|---|---|---|---|---|
| ipsAuthMibModule | 1.3.6.1.2.1.141 | The IP Storage Authorization MIB module. Copyright (C) The Internet Society (2006). This version of this MIB module is part of RFC 4545; see the RFC itself for full legal notices. | ||
| ipsAuthNotifications | 1.3.6.1.2.1.141.0 | |||
| ipsAuthObjects | 1.3.6.1.2.1.141.1 | |||
| ipsAuthDescriptors | 1.3.6.1.2.1.141.1.1 | |||
| ipsAuthMethodTypes | 1.3.6.1.2.1.141.1.1.1 | Registration point for Authentication Method Types. | ||
| ipsAuthMethodNone | 1.3.6.1.2.1.141.1.1.1.1 | The authoritative identifier when no authentication method is used. | ||
| ipsAuthMethodSrp | 1.3.6.1.2.1.141.1.1.1.2 | The authoritative identifier when the authentication method is SRP. | ||
| ipsAuthMethodChap | 1.3.6.1.2.1.141.1.1.1.3 | The authoritative identifier when the authentication method is CHAP. | ||
| ipsAuthMethodKerberos | 1.3.6.1.2.1.141.1.1.1.4 | The authoritative identifier when the authentication method is Kerberos. | ||
| ipsAuthInstance | 1.3.6.1.2.1.141.1.2 | |||
| ipsAuthInstanceAttributesTable | 1.3.6.1.2.1.141.1.2.2 | not-accessible | A list of Authorization instances present on the system. | |
| ipsAuthInstanceAttributesEntry | 1.3.6.1.2.1.141.1.2.2.1 | not-accessible | An entry (row) containing management information applicable to a particular Authorization instance. | |
| U32 ipsAuthInstIndex | 1.3.6.1.2.1.141.1.2.2.1.1 | Unsigned32 | not-accessible | An arbitrary integer used to uniquely identify a particular authorization instance. This index value must not be modified or reused by an agent unless a reboot has occurred. An agent should attempt to keep this value persistent across reboots. |
| STR ipsAuthInstDescr | 1.3.6.1.2.1.141.1.2.2.1.2 | SnmpAdminString | read-write | A character string, determined by the implementation to describe the authorization instance. When only a single instance is present, this object may be set to the zero-length string; with multiple authorization instances, it must be set to a unique value in an implementation-dependent manner to describe the purpose of the respective instance. If this is deployed in a master agent with more than one subagent implementing this MIB module, the master agent is responsible for ensuring that this object is unique across all subagents. |
| STO ipsAuthInstStorageType | 1.3.6.1.2.1.141.1.2.2.1.3 | StorageType | read-write | The storage type for all read-write objects within this row. Rows in this table are always created via an external process, and may have a storage type of readOnly or permanent. Conceptual rows having the value 'permanent' need not allow write access to any columnar objects in the row. If this object has the value 'volatile', modifications to read-write objects in this row are not persistent across reboots. If this object has the value 'nonVolatile', modifications to objects in this row are persistent. An implementation may choose to allow this object to be set to either 'nonVolatile' or 'volatile', allowing the management application to choose this behavior. |
| ipsAuthIdentity | 1.3.6.1.2.1.141.1.3 | |||
| ipsAuthIdentAttributesTable | 1.3.6.1.2.1.141.1.3.1 | not-accessible | A list of user identities, each belonging to a particular ipsAuthInstance. | |
| ipsAuthIdentAttributesEntry | 1.3.6.1.2.1.141.1.3.1.1 | not-accessible | An entry (row) containing management information describing a user identity within an authorization instance on this node. | |
| U32 ipsAuthIdentIndex | 1.3.6.1.2.1.141.1.3.1.1.1 | Unsigned32 | not-accessible | An arbitrary integer used to uniquely identify a particular identity instance within an authorization instance present on the node. This index value must not be modified or reused by an agent unless a reboot has occurred. An agent should attempt to keep this value persistent across reboots. |
| STR ipsAuthIdentDescription | 1.3.6.1.2.1.141.1.3.1.1.2 | SnmpAdminString | read-create | A character string describing this particular identity. |
| ROW ipsAuthIdentRowStatus | 1.3.6.1.2.1.141.1.3.1.1.3 | RowStatus | read-create | This field allows entries to be dynamically added and removed from this table via SNMP. When adding a row to this table, all non-Index/RowStatus objects must be set. Rows may be discarded using RowStatus. The value of ipsAuthIdentDescription may be set while ipsAuthIdentRowStatus is 'active'. |
| STO ipsAuthIdentStorageType | 1.3.6.1.2.1.141.1.3.1.1.4 | StorageType | read-create | The storage type for all read-create objects in this row. Rows in this table that were created through an external process may have a storage type of readOnly or permanent. Conceptual rows having the value 'permanent' need not allow write access to any columnar objects in the row. |
| ipsAuthIdentityName | 1.3.6.1.2.1.141.1.4 | |||
| ipsAuthIdentNameAttributesTable | 1.3.6.1.2.1.141.1.4.1 | not-accessible | A list of unique names that can be used to positively identify a particular user identity. | |
| ipsAuthIdentNameAttributesEntry | 1.3.6.1.2.1.141.1.4.1.1 | not-accessible | An entry (row) containing management information applicable to a unique identity name, which can be used to identify a user identity within a particular authorization instance. | |
| U32 ipsAuthIdentNameIndex | 1.3.6.1.2.1.141.1.4.1.1.1 | Unsigned32 | not-accessible | An arbitrary integer used to uniquely identify a particular identity name instance within an ipsAuthIdentity within an authorization instance. This index value must not be modified or reused by an agent unless a reboot has occurred. An agent should attempt to keep this value persistent across reboots. |
| STR ipsAuthIdentName | 1.3.6.1.2.1.141.1.4.1.1.2 | SnmpAdminString | read-create | A character string that is the unique name of an identity that may be used to identify this ipsAuthIdent entry. |
| ROW ipsAuthIdentNameRowStatus | 1.3.6.1.2.1.141.1.4.1.1.3 | RowStatus | read-create | This field allows entries to be dynamically added and removed from this table via SNMP. When adding a row to this table, all non-Index/RowStatus objects must be set. Rows may be discarded using RowStatus. The value of ipsAuthIdentName may be set when this value is 'active'. |
| STO ipsAuthIdentNameStorageType | 1.3.6.1.2.1.141.1.4.1.1.4 | StorageType | read-create | The storage type for all read-create objects in this row. Rows in this table that were created through an external process may have a storage type of readOnly or permanent. Conceptual rows having the value 'permanent' need not allow write access to any columnar objects in the row. |
| ipsAuthIdentityAddress | 1.3.6.1.2.1.141.1.5 | |||
| ipsAuthIdentAddrAttributesTable | 1.3.6.1.2.1.141.1.5.1 | not-accessible | A list of address ranges that are allowed to serve as the endpoint addresses of a particular identity. An address range includes a starting and ending address and an optional netmask, and an address type indicator, which can specify whether the address is IPv4, IPv6, FC-WWPN, or FC-WWNN. | |
| ipsAuthIdentAddrAttributesEntry | 1.3.6.1.2.1.141.1.5.1.1 | not-accessible | An entry (row) containing management information applicable to an address range that is used as part of the authorization of an identity within an authorization instance on this node. | |
| U32 ipsAuthIdentAddrIndex | 1.3.6.1.2.1.141.1.5.1.1.1 | Unsigned32 | not-accessible | An arbitrary integer used to uniquely identify a particular ipsAuthIdentAddress instance within an ipsAuthIdentity within an authorization instance present on the node. This index value must not be modified or reused by an agent unless a reboot has occurred. An agent should attempt to keep this value persistent across reboots. |
| ADR ipsAuthIdentAddrType | 1.3.6.1.2.1.141.1.5.1.1.2 | AddressFamilyNumbers | read-create | The address types used in the ipsAuthIdentAddrStart and ipsAuthAddrEnd objects. This type is taken from the IANA address family types. |
| ADR ipsAuthIdentAddrStart | 1.3.6.1.2.1.141.1.5.1.1.3 | IpsAuthAddress | read-create | The starting address of the allowed address range. The format of this object is determined by ipsAuthIdentAddrType. |
| ADR ipsAuthIdentAddrEnd | 1.3.6.1.2.1.141.1.5.1.1.4 | IpsAuthAddress | read-create | The ending address of the allowed address range. If the ipsAuthIdentAddrEntry specifies a single address, this shall match the ipsAuthIdentAddrStart. The format of this object is determined by ipsAuthIdentAddrType. |
| ROW ipsAuthIdentAddrRowStatus | 1.3.6.1.2.1.141.1.5.1.1.5 | RowStatus | read-create | This field allows entries to be dynamically added and removed from this table via SNMP. When adding a row to this table, all non-Index/RowStatus objects must be set. Rows may be discarded using RowStatus. The values of ipsAuthIdentAddrStart and ipsAuthIdentAddrEnd may be set when this value is 'active'. The value of ipsAuthIdentAddrType may not be set when this value is 'active'. |
| STO ipsAuthIdentAddrStorageType | 1.3.6.1.2.1.141.1.5.1.1.6 | StorageType | read-create | The storage type for all read-create objects in this row. Rows in this table that were created through an external process may have a storage type of readOnly or permanent. Conceptual rows having the value 'permanent' need not allow write access to any columnar objects in the row. |
| ipsAuthCredential | 1.3.6.1.2.1.141.1.6 | |||
| ipsAuthCredentialAttributesTable | 1.3.6.1.2.1.141.1.6.1 | not-accessible | A list of credentials related to user identities that are allowed as valid authenticators of the particular identity. | |
| ipsAuthCredentialAttributesEntry | 1.3.6.1.2.1.141.1.6.1.1 | not-accessible | An entry (row) containing management information applicable to a credential that verifies a user identity within an authorization instance. To provide complete information in this MIB for a credential, the management station must not only create the row in this table but must also create a row in another table, where the other table is determined by the value of ipsAuthCredAuthMethod, e.g., if ipsAuthCredAuthMethod has the value ipsAuthMethodChap, a row must be created in the ipsAuthCredChapAttributesTable. | |
| U32 ipsAuthCredIndex | 1.3.6.1.2.1.141.1.6.1.1.1 | Unsigned32 | not-accessible | An arbitrary integer used to uniquely identify a particular Credential instance within an instance present on the node. This index value must not be modified or reused by an agent unless a reboot has occurred. An agent should attempt to keep this value persistent across reboots. |
| OID ipsAuthCredAuthMethod | 1.3.6.1.2.1.141.1.6.1.1.2 | AutonomousType | read-create | This object contains an OBJECT IDENTIFIER that identifies the authentication method used with this credential. When a row is created in this table, a corresponding row must be created by the management station in a corresponding table specified by this value. When a row is deleted from this table, the corresponding row must be automatically deleted by the agent in the corresponding table specified by this value. If the value of this object is ipsAuthMethodNone, no corresponding rows are created or deleted from other tables. Some standardized values for this object are defined within the ipsAuthMethodTypes subtree. |
| ROW ipsAuthCredRowStatus | 1.3.6.1.2.1.141.1.6.1.1.3 | RowStatus | read-create | This field allows entries to be dynamically added and removed from this table via SNMP. When adding a row to this table, all non-Index/RowStatus objects must be set. Rows may be discarded using RowStatus. The value of ipsAuthCredAuthMethod must not be changed while this row is 'active'. |
| STO ipsAuthCredStorageType | 1.3.6.1.2.1.141.1.6.1.1.4 | StorageType | read-create | The storage type for all read-create objects in this row. Rows in this table that were created through an external process may have a storage type of readOnly or permanent. Conceptual rows having the value 'permanent' need not allow write access to any columnar objects in the row. |
| ipsAuthCredChap | 1.3.6.1.2.1.141.1.7 | |||
| ipsAuthCredChapAttributesTable | 1.3.6.1.2.1.141.1.7.1 | not-accessible | A list of CHAP attributes for credentials that use ipsAuthMethodChap as their ipsAuthCredAuthMethod. A row in this table can only exist when an instance of the ipsAuthCredAuthMethod object exists (or is created simultaneously) having the same instance identifiers and a value of 'ipsAuthMethodChap'. | |
| ipsAuthCredChapAttributesEntry | 1.3.6.1.2.1.141.1.7.1.1 | not-accessible | An entry (row) containing management information applicable to a credential that uses ipsAuthMethodChap as their ipsAuthCredAuthMethod. When a row is created in ipsAuthCredentialAttributesTable with ipsAuthCredAuthMethod = ipsAuthCredChap, the management station must create a corresponding row in this table. When a row is deleted from ipsAuthCredentialAttributesTable with ipsAuthCredAuthMethod = ipsAuthCredChap, the agent must delete the corresponding row (if any) in this table. | |
| STR ipsAuthCredChapUserName | 1.3.6.1.2.1.141.1.7.1.1.1 | SnmpAdminString | read-create | A character string containing the CHAP user name for this credential. |
| ROW ipsAuthCredChapRowStatus | 1.3.6.1.2.1.141.1.7.1.1.2 | RowStatus | read-create | This field allows entries to be dynamically added and removed from this table via SNMP. When adding a row to this table, all non-Index/RowStatus objects must be set. Rows may be discarded using RowStatus. The value of ipsAuthCredChapUserName may be changed while this row is 'active'. |
| STO ipsAuthCredChapStorageType | 1.3.6.1.2.1.141.1.7.1.1.3 | StorageType | read-create | The storage type for all read-create objects in this row. Rows in this table that were created through an external process may have a storage type of readOnly or permanent. Conceptual rows having the value 'permanent' need not allow write access to any columnar objects in the row. |
| ipsAuthCredSrp | 1.3.6.1.2.1.141.1.8 | |||
| ipsAuthCredSrpAttributesTable | 1.3.6.1.2.1.141.1.8.1 | not-accessible | A list of SRP attributes for credentials that use ipsAuthMethodSrp as its ipsAuthCredAuthMethod. A row in this table can only exist when an instance of the ipsAuthCredAuthMethod object exists (or is created simultaneously) having the same instance identifiers and a value of 'ipsAuthMethodSrp'. | |
| ipsAuthCredSrpAttributesEntry | 1.3.6.1.2.1.141.1.8.1.1 | not-accessible | An entry (row) containing management information applicable to a credential that uses ipsAuthMethodSrp as their ipsAuthCredAuthMethod. When a row is created in ipsAuthCredentialAttributesTable with ipsAuthCredAuthMethod = ipsAuthCredSrp, the management station must create a corresponding row in this table. When a row is deleted from ipsAuthCredentialAttributesTable with ipsAuthCredAuthMethod = ipsAuthCredSrp, the agent must delete the corresponding row (if any) in this table. | |
| STR ipsAuthCredSrpUserName | 1.3.6.1.2.1.141.1.8.1.1.1 | SnmpAdminString | read-create | A character string containing the SRP user name for this credential. |
| ROW ipsAuthCredSrpRowStatus | 1.3.6.1.2.1.141.1.8.1.1.2 | RowStatus | read-create | This field allows entries to be dynamically added and removed from this table via SNMP. When adding a row to this table, all non-Index/RowStatus objects must be set. Rows may be discarded using RowStatus. The value of ipsAuthCredSrpUserName may be changed while the status of this row is 'active'. |
| STO ipsAuthCredSrpStorageType | 1.3.6.1.2.1.141.1.8.1.1.3 | StorageType | read-create | The storage type for all read-create objects in this row. Rows in this table that were created through an external process may have a storage type of readOnly or permanent. Conceptual rows having the value 'permanent' need not allow write access to any columnar objects in the row. |
| ipsAuthCredKerberos | 1.3.6.1.2.1.141.1.9 | |||
| ipsAuthCredKerbAttributesTable | 1.3.6.1.2.1.141.1.9.1 | not-accessible | A list of Kerberos attributes for credentials that use ipsAuthMethodKerberos as their ipsAuthCredAuthMethod. A row in this table can only exist when an instance of the ipsAuthCredAuthMethod object exists (or is created simultaneously) having the same instance identifiers and a value of 'ipsAuthMethodKerb'. | |
| ipsAuthCredKerbAttributesEntry | 1.3.6.1.2.1.141.1.9.1.1 | not-accessible | An entry (row) containing management information applicable to a credential that uses ipsAuthMethodKerberos as its ipsAuthCredAuthMethod. When a row is created in ipsAuthCredentialAttributesTable with ipsAuthCredAuthMethod = ipsAuthCredKerberos, the management station must create a corresponding row in this table. When a row is deleted from ipsAuthCredentialAttributesTable with ipsAuthCredAuthMethod = ipsAuthCredKerberos, the agent must delete the corresponding row (if any) in this table. | |
| STR ipsAuthCredKerbPrincipal | 1.3.6.1.2.1.141.1.9.1.1.1 | SnmpAdminString | read-create | A character string containing a Kerberos principal for this credential. |
| ROW ipsAuthCredKerbRowStatus | 1.3.6.1.2.1.141.1.9.1.1.2 | RowStatus | read-create | This field allows entries to be dynamically added and removed from this table via SNMP. When adding a row to this table, all non-Index/RowStatus objects must be set. Rows may be discarded using RowStatus. The value of ipsAuthCredKerbPrincipal may be changed while this row is 'active'. |
| STO ipsAuthCredKerbStorageType | 1.3.6.1.2.1.141.1.9.1.1.3 | StorageType | read-create | The storage type for all read-create objects in this row. Rows in this table that were created through an external process may have a storage type of readOnly or permanent. Conceptual rows having the value 'permanent' need not allow write access to any columnar objects in the row. |
| ipsAuthConformance | 1.3.6.1.2.1.141.2 | |||
| ipsAuthCompliances | 1.3.6.1.2.1.141.2.1 | |||
| ipsAuthComplianceV1 | 1.3.6.1.2.1.141.2.1.1 | Initial version of compliance statement based on initial version of this MIB module. The Instance and Identity groups are mandatory; at least one of the other groups (Name, Address, Credential, Certificate) is also mandatory for any given implementation. | ||
| ipsAuthGroups | 1.3.6.1.2.1.141.2.2 | |||
| ipsAuthInstanceAttributesGroup | 1.3.6.1.2.1.141.2.2.1 | A collection of objects providing information about authorization instances. | ||
| ipsAuthIdentAttributesGroup | 1.3.6.1.2.1.141.2.2.2 | A collection of objects providing information about user identities within an authorization instance. | ||
| ipsAuthIdentNameAttributesGroup | 1.3.6.1.2.1.141.2.2.3 | A collection of objects providing information about user names within user identities within an authorization instance. | ||
| ipsAuthIdentAddrAttributesGroup | 1.3.6.1.2.1.141.2.2.4 | A collection of objects providing information about address ranges within user identities within an authorization instance. | ||
| ipsAuthIdentCredAttributesGroup | 1.3.6.1.2.1.141.2.2.5 | A collection of objects providing information about credentials within user identities within an authorization instance. | ||
| ipsAuthIdentChapAttrGroup | 1.3.6.1.2.1.141.2.2.6 | A collection of objects providing information about CHAP credentials within user identities within an authorization instance. | ||
| ipsAuthIdentSrpAttrGroup | 1.3.6.1.2.1.141.2.2.7 | A collection of objects providing information about SRP credentials within user identities within an authorization instance. | ||
| ipsAuthIdentKerberosAttrGroup | 1.3.6.1.2.1.141.2.2.8 | A collection of objects providing information about Kerberos credentials within user identities within an authorization instance. |
RFC description
IP Storage (iSCSI/Fibre Channel) authentication and address management.
Start monitoring Vendor-neutral IETF standard, RFC 4545 (IP storage iSCSI/FCIP gateway or storage router) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.