diff --git a/models/openconfig/src/main/yang/system/openconfig-aaa.yang b/models/openconfig/src/main/yang/system/openconfig-aaa.yang
new file mode 100644
index 0000000..5a68c47
--- /dev/null
+++ b/models/openconfig/src/main/yang/system/openconfig-aaa.yang
@@ -0,0 +1,791 @@
+module openconfig-aaa {
+
+  yang-version "1";
+
+  // namespace
+  namespace "http://openconfig.net/yang/aaa";
+
+  prefix "oc-aaa";
+
+  // import some basic types
+  import openconfig-extensions { prefix oc-ext; }
+  import ietf-inet-types { prefix inet; }
+  import ietf-yang-types { prefix yang; }
+  import openconfig-aaa-types { prefix oc-aaa-types; }
+
+  include openconfig-aaa-tacacs;
+  include openconfig-aaa-radius;
+
+
+  // meta
+  organization "OpenConfig working group";
+
+  contact
+    "OpenConfig working group
+    www.openconfig.net";
+
+  description
+    "This module defines configuration and operational state data
+    related to authorization, authentication, and accounting (AAA)
+    management.
+
+    Portions of this model reuse data definitions or structure from
+    RFC 7317 - A YANG Data Model for System Management";
+
+  oc-ext:openconfig-version "0.2.0";
+
+  revision "2017-07-06" {
+    description
+      "Move to oc-inet types, add IETF attribution, add RADIUS
+      counters, changed password leaf names to indicate hashed";
+    reference "0.2.0";
+  }
+
+  revision "2017-01-29" {
+    description
+      "Initial public release";
+    reference "0.1.0";
+  }
+
+  // identity statements
+
+  // grouping statements
+  grouping aaa-servergroup-common-config {
+    description
+      "Configuration data for AAA server groups";
+
+    leaf name {
+      type string;
+      description
+        "Name for the server group";
+    }
+
+    leaf type {
+      type identityref {
+        base oc-aaa-types:AAA_SERVER_TYPE;
+      }
+      description
+        "AAA server type -- all servers in the group must be of this
+        type";
+    }
+  }
+
+  grouping aaa-servergroup-common-state {
+    description
+      "Operational state data for AAA server groups";
+
+    //TODO: add list of group members as opstate
+  }
+
+  grouping aaa-servergroup-common-top {
+    description
+      "Top-level grouping for AAA server groups";
+
+    container server-groups {
+      description
+        "Enclosing container for AAA server groups";
+
+      list server-group {
+        key "name";
+        description
+          "List of AAA server groups.  All servers in a group
+          must have the same type as indicated by the server
+          type.";
+
+        leaf name {
+          type leafref {
+            path "../config/name";
+          }
+          description
+            "Reference to configured name of the server group";
+        }
+
+        container config {
+          description
+            "Configuration data for each server group";
+
+          uses aaa-servergroup-common-config;
+        }
+
+        container state {
+          config false;
+
+          description
+            "Operational state data for each server group";
+
+          uses aaa-servergroup-common-config;
+          uses aaa-servergroup-common-state;
+        }
+
+        uses aaa-server-top;
+      }
+    }
+  }
+
+  grouping aaa-server-config {
+    description
+      "Common configuration data for AAA servers";
+
+    leaf name {
+      type string;
+      description
+        "Name assigned to the server";
+    }
+
+
+    leaf address {
+      type inet:ip-address;
+      description "Address of the authentication server";
+    }
+
+    leaf timeout {
+      type uint16;
+      units seconds;
+      description
+        "Set the timeout in seconds on responses from the AAA
+        server";
+    }
+  }
+
+  grouping aaa-server-state {
+    description
+      "Common operational state data for AAA servers";
+
+    leaf connection-opens {
+      type yang:counter64;
+      description
+        "Number of new connection requests sent to the server, e.g.
+        socket open";
+    }
+
+    leaf connection-closes {
+      type yang:counter64;
+      description
+        "Number of connection close requests sent to the server, e.g.
+        socket close";
+    }
+
+    leaf connection-aborts {
+      type yang:counter64;
+      description
+        "Number of aborted connections to the server.  These do
+        not include connections that are close gracefully.";
+    }
+
+    leaf connection-failures {
+      type yang:counter64;
+      description
+        "Number of connection failures to the server";
+    }
+
+    leaf connection-timeouts {
+      type yang:counter64;
+      description
+        "Number of connection timeouts to the server";
+    }
+
+    leaf messages-sent {
+      type yang:counter64;
+      description
+        "Number of messages sent to the server";
+    }
+
+    leaf messages-received {
+      type yang:counter64;
+      description
+        "Number of messages received by the server";
+    }
+
+    leaf errors-received {
+      type yang:counter64;
+      description
+        "Number of error messages received from the server";
+    }
+
+  }
+
+  grouping aaa-server-top {
+    description
+      "Top-level grouping for list of AAA servers";
+
+    container servers {
+      description
+        "Enclosing container the list of servers";
+
+      list server {
+        key "address";
+        description
+          "List of AAA servers";
+
+        leaf address {
+          type leafref {
+            path "../config/address";
+          }
+          description
+            "Reference to the configured address of the AAA server";
+        }
+
+        container config {
+          description
+            "Configuration data ";
+
+          uses aaa-server-config;
+        }
+
+        container state {
+          config false;
+
+          description
+            "Operational state data ";
+
+          uses aaa-server-config;
+          uses aaa-server-state;
+        }
+        uses aaa-tacacs-server-top;
+        uses aaa-radius-server-top;
+      }
+    }
+  }
+
+  grouping aaa-admin-config {
+    description
+      "Configuration data for the system built-in
+      administrator / root user account";
+
+    leaf admin-password {
+      type string;
+      oc-ext:openconfig-hashed-value;
+      description
+        "The admin/root password, supplied as a cleartext string.
+        The system should hash and only store the password as a
+        hashed value.";
+    }
+
+    leaf admin-password-hashed {
+      type oc-aaa-types:crypt-password-type;
+      description
+        "The admin/root password, supplied as a hashed value
+        using the notation described in the definition of the
+        crypt-password-type.";
+    }
+  }
+
+  grouping aaa-admin-state {
+    description
+      "Operational state data for the root user";
+
+    leaf admin-username {
+      type string;
+      description
+        "Name of the administrator user account, e.g., admin, root,
+        etc.";
+    }
+  }
+
+  grouping aaa-authentication-admin-top {
+    description
+      "Top-level grouping for root user configuration and state
+      data";
+
+    container admin-user {
+      description
+        "Top-level container for the system root or admin user
+        configuration and operational state";
+
+      container config {
+        description
+          "Configuration data for the root user account";
+
+        uses aaa-admin-config;
+      }
+
+      container state {
+        config false;
+
+        description
+          "Operational state data for the root user account";
+
+        uses aaa-admin-config;
+        uses aaa-admin-state;
+      }
+    }
+  }
+  grouping aaa-authentication-user-config {
+    description
+      "Configuration data for local users";
+
+    leaf username {
+      type string;
+      description
+        "Assigned username for this user";
+    }
+
+    leaf password {
+      type string;
+      oc-ext:openconfig-hashed-value;
+      description
+        "The user password, supplied as cleartext.  The system
+        must hash the value and only store the hashed value.";
+    }
+
+    leaf password-hashed {
+      type oc-aaa-types:crypt-password-type;
+      description
+        "The user password, supplied as a hashed value
+        using the notation described in the definition of the
+        crypt-password-type.";
+    }
+
+    leaf ssh-key {
+      type string;
+      description
+        "SSH public key for the user (RSA or DSA)";
+    }
+
+    leaf role {
+      type union {
+        type string;
+        type identityref {
+          base oc-aaa-types:SYSTEM_DEFINED_ROLES;
+        }
+      }
+      description
+        "Role assigned to the user.  The role may be supplied
+        as a string or a role defined by the SYSTEM_DEFINED_ROLES
+        identity.";
+    }
+  }
+
+  grouping aaa-authentication-user-state {
+    description
+      "Operational state data for local users";
+  }
+
+  grouping aaa-authentication-user-top {
+    description
+      "Top-level grouping for local users";
+
+    container users {
+      description
+        "Enclosing container list of local users";
+
+      list user {
+        key "username";
+        description
+          "List of local users on the system";
+
+        leaf username {
+          type leafref {
+            path "../config/username";
+          }
+          description
+            "References the configured username for the user";
+        }
+
+        container config {
+          description
+            "Configuration data for local users";
+
+          uses aaa-authentication-user-config;
+        }
+
+        container state {
+          config false;
+
+          description
+            "Operational state data for local users";
+
+          uses aaa-authentication-user-config;
+          uses aaa-authentication-user-state;
+        }
+      }
+
+    }
+  }
+
+  grouping aaa-accounting-methods-common {
+    description
+      "Common definitions for accounting methods";
+
+    leaf-list accounting-method {
+      type union {
+        type identityref {
+          base oc-aaa-types:AAA_METHOD_TYPE;
+        }
+        type string;
+        //TODO:  in YANG 1.1 this should be converted to a leafref to
+        //point to the server group name.
+      }
+      description
+        "The method used for AAA accounting for this event
+        type.  The method is defined by the destination for
+        accounting data, which may be specified as the group of
+        all TACACS+/RADIUS servers, a defined server group, or
+        the local system.";
+    }
+  }
+
+
+  grouping aaa-accounting-events-config {
+    description
+      "Configuration data for AAA accounting events";
+
+    leaf event-type {
+      type identityref {
+        base oc-aaa-types:AAA_ACCOUNTING_EVENT_TYPE;
+      }
+      description
+        "The type of activity to record at the AAA accounting
+        server";
+    }
+
+    leaf record {
+      type enumeration {
+        enum START_STOP {
+          description
+            "Send START record to the accounting server at the
+            beginning of the activity, and STOP record at the
+            end of the activity.";
+        }
+        enum STOP {
+          description
+            "Send STOP record to the accounting server when the
+            user activity completes";
+        }
+      }
+      description
+        "Type of record to send to the accounting server for this
+        activity type";
+    }
+  }
+
+  grouping aaa-accounting-events-state {
+    description
+      "Operational state data for accounting events";
+  }
+
+  grouping aaa-accounting-events-top {
+    description
+      "Top-level grouping for accounting events";
+
+    container events {
+      description
+        "Enclosing container for defining handling of events
+        for accounting";
+
+      list event {
+        key "event-type";
+        description
+          "List of events subject to accounting";
+
+        leaf event-type {
+          type leafref {
+            path "../config/event-type";
+          }
+          description
+            "Reference to the event-type being logged at the
+            accounting server";
+        }
+
+        container config {
+          description
+            "Configuration data for accounting events";
+
+          uses aaa-accounting-events-config;
+        }
+
+        container state {
+          config false;
+
+          description
+            "Operational state data for accounting events";
+
+          uses aaa-accounting-events-config;
+          uses aaa-accounting-events-state;
+        }
+      }
+    }
+  }
+
+  grouping aaa-accounting-config {
+    description
+      "Configuration data for event accounting";
+
+    uses aaa-accounting-methods-common;
+
+  }
+
+  grouping aaa-accounting-state {
+    description
+      "Operational state data for event accounting services";
+  }
+
+  grouping aaa-accounting-top {
+    description
+      "Top-level grouping for user activity accounting";
+
+    container accounting {
+      description
+        "Top-level container for AAA accounting";
+
+      container config {
+        description
+          "Configuration data for user activity accounting.";
+
+        uses aaa-accounting-config;
+      }
+
+      container state {
+        config false;
+
+        description
+          "Operational state data for user accounting.";
+
+        uses aaa-accounting-config;
+        uses aaa-accounting-state;
+      }
+
+      uses aaa-accounting-events-top;
+
+    }
+  }
+
+  grouping aaa-authorization-methods-config {
+    description
+      "Common definitions for authorization methods for global
+      and per-event type";
+
+    leaf-list authorization-method {
+      type union {
+        type identityref {
+          base oc-aaa-types:AAA_METHOD_TYPE;
+        }
+        type string;
+      }
+      description
+        "Ordered list of methods for authorizing commands.  The first
+        method that provides a response (positive or negative) should
+        be used.  The list may contain a well-defined method such
+        as the set of all TACACS or RADIUS servers, or the name of
+        a defined AAA server group.  The system must validate
+        that the named server group exists.";
+    }
+  }
+
+  grouping aaa-authorization-events-config {
+    description
+      "Configuration data for AAA authorization events";
+
+    leaf event-type {
+      type identityref {
+        base oc-aaa-types:AAA_AUTHORIZATION_EVENT_TYPE;
+      }
+      description
+        "The type of event to record at the AAA authorization
+        server";
+    }
+  }
+
+  grouping aaa-authorization-events-state {
+    description
+      "Operational state data for AAA authorization events";
+  }
+
+  grouping aaa-authorization-events-top {
+    description
+      "Top-level grouping for authorization events";
+
+    container events {
+      description
+        "Enclosing container for the set of events subject
+        to authorization";
+
+      list event {
+        key "event-type";
+        description
+          "List of events subject to AAA authorization";
+
+        leaf event-type {
+          type leafref {
+            path "../config/event-type";
+          }
+          description
+            "Reference to the event-type list key";
+        }
+
+        container config {
+          description
+            "Configuration data for each authorized event";
+
+          uses aaa-authorization-events-config;
+        }
+
+        container state {
+          config false;
+
+          description
+            "Operational state data for each authorized activity";
+
+          uses aaa-authorization-events-config;
+          uses aaa-authorization-events-state;
+        }
+      }
+    }
+  }
+
+  grouping aaa-authorization-config {
+    description
+      "Configuration data for AAA authorization";
+
+    uses aaa-authorization-methods-config;
+  }
+
+  grouping aaa-authorization-state {
+    description
+      "Operational state data for AAA authorization";
+  }
+
+  grouping aaa-authorization-top {
+    description
+      "Top-level grouping for AAA authorization";
+
+    container authorization {
+      description
+        "Top-level container for AAA authorization configuration
+        and operational state data";
+
+      container config {
+        description
+          "Configuration data for authorization based on AAA
+          methods";
+
+        uses aaa-authorization-config;
+      }
+
+      container state {
+        config false;
+
+        description
+          "Operational state data for authorization based on AAA";
+
+        uses aaa-authorization-config;
+        uses aaa-authorization-state;
+      }
+
+      uses aaa-authorization-events-top;
+
+    }
+  }
+
+  grouping aaa-authentication-config {
+    description
+      "Configuration data for global authentication";
+
+    leaf-list authentication-method {
+      type union {
+        type identityref {
+          base oc-aaa-types:AAA_METHOD_TYPE;
+        }
+        type string;
+        //TODO: string should be a leafref to a defined
+        //server group.  this will be possible in YANG 1.1
+        //type leafref {
+          //path "/aaa/server-groups/server-group/config/name";
+        //}
+      }
+      ordered-by user;
+      description
+        "Ordered list of authentication methods for users.  This
+        can be either a reference to a server group, or a well-
+        defined designation in the AAA_METHOD_TYPE identity.  If
+        authentication fails with one method, the next defined
+        method is tried -- failure of all methods results in the
+        user being denied access.";
+    }
+  }
+
+  grouping aaa-authentication-state {
+    description
+      "Operational state data for global authentication";
+  }
+
+  grouping aaa-authentication-top {
+    description
+      "Top-level grouping for top-level authentication";
+
+    container authentication {
+      description
+        "Top-level container for global authentication data";
+
+      container config {
+        description
+          "Configuration data for global authentication services";
+
+        uses aaa-authentication-config;
+      }
+
+      container state {
+        config false;
+
+        description
+          "Operational state data for global authentication
+          services";
+
+        uses aaa-authentication-config;
+        uses aaa-authentication-state;
+      }
+
+      uses aaa-authentication-admin-top;
+      uses aaa-authentication-user-top;
+    }
+  }
+
+  grouping aaa-config {
+    description
+      "Configuration data for top level AAA";
+  }
+
+  grouping aaa-state {
+    description
+      "Operational state data for top level AAA";
+  }
+
+  grouping aaa-top {
+    description
+      "Top-level grouping for AAA services";
+
+    container aaa {
+      description
+        "Top-level container for AAA services";
+
+      container config {
+        description
+          "Configuration data for top level AAA services";
+
+        uses aaa-config;
+      }
+
+      container state {
+        config false;
+
+        description
+          "Operational state data for top level AAA services ";
+
+        uses aaa-config;
+        uses aaa-state;
+      }
+
+      uses aaa-authentication-top;
+      uses aaa-authorization-top;
+      uses aaa-accounting-top;
+      uses aaa-servergroup-common-top;
+
+    }
+  }
+
+
+
+  // data definition statements
+
+
+}