Tacacs+ scenario: can I permit user to configure only for one interface and deny others

Question

I'm currently deploying TACACS+ with a Cisco device, I use a TACACS server from here: http://www.shrubbery.net/tac_plus/

My scenario is: I want to permit a user to configure my router but only for a specific interface, i.e to gigabitethernet0/0. After arriving at the router(config-if)# that user can do whatever he wants with that interface, but he cannot change to another interface nor change the configuration in the router(config)# .
So far my configuration in tac_plus.conf is like this:

#limited admin group = limitedadmin {
default service = deny
service = shell {
priv-lvl = 15
}
cmd = configure {
permit terminal
}
cmd = interface {
permit "GigabitEthernet 0/0"
}}

And this is the Cisco config:

aaa new-model
aaa authentication login default group tacacs+ local
aaa authentication login telnet group tacacs+ local
aaa authentication login lokal local enable
aaa authorization config-commands
aaa authorization exec default group tacacs+ local 
aaa authorization exec telnet group tacacs+ 
aaa authorization commands 1 default group tacacs+ local 
aaa authorization commands 15 default group tacacs+ local 
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+

But with this, I cannot specifically permit that user at config-if without allowing him to configure at router(config) too.

Is my scenario possible using TACACS+ ?

Answer 1

Im sure there is relam for this but what can i remember from my days as nw guy that priveleges are based upon command sensitvity not port wise. What command is executed is where you define control It make sense as where user x an configure interface ip or speed and do the same for 100 interfaces its the same trust level.

As for config-if works in inheritence fashion it automatically inherets all privelegs for config level.

 default service = deny
 cmd = interface { permit [faFAgiGI].* }

This would make users to have access to issue "interface Gi." or "interface Fa.". I do not want them to have the ability to issue "interface Te.*".