User Guide for Cisco Secure Access Control Server - Stewing Home

About Certification and EAP Protocols
EAP-TLS Limitations
9-4
User Guide for Cisco Secure Access Control Server 4.2
Chapter 9 System Configuration: Authentication and Certificates
In effect, enabling an EAP-TLS session resume allows ACS to trust a user based on the cached TLS
session from the original EAP-TLS authentication. Because ACS only caches a TLS session when a new
EAP-TLS authentication succeeds, the existence of a cached TLS session is proof that the user has
successfully authenticated in the number of minutes that the EAP-TLS session timeout option specified.
Note Session timeout is based on the time of the initial, full authentication of the session. It does not depend
on an accounting start message.
The Session resume feature does not enforce changes to the group assignment in an external user
database; because group mapping does not occur when a user session is resumed. Instead, the user is
mapped to the same ACS group to which the user was mapped at the beginning of the session. At the
start of a new session, group mapping enforces the new group assignment.
To force an EAP-TLS session to end before the session timeout is reached, you can restart the CSAuth
service or delete the user from the ACS user database. Disabling or deleting the user in an external user
database has no effect because the session resume feature does not involve the use of external user
databases.
You can enable the EAP-TLS session resume feature and configure the timeout interval on the Global
Authentication Setup page. For more information about enabling this feature, see Global Authentication
Setup, page 9-21.
The limitations in the ACS implementation of EAP-TLS are:
Server and CA certificate file format—If you install the ACS server and CA certificates from files,
rather than from certificate storage, server and CA certificate files must be in Base64-encoded X.509
format or DER-encoded binary X.509 format.
LDAP attribute for binary comparison—If you configure ACS to perform binary comparison of
user certificates, the user certificate must be stored in the Active Directory or an LDAP server by
using a binary format. Also, the attribute storing the certificate must be named usercertificate.
Windows server type—If you want to use Active Directory to authenticate users with EAP-TLS
when ACS runs on a member server, additional configuration is required. For more information,
including steps for the additional configuration, see the Installation Guide for Cisco Secure ACS for
Windows Release 4.2 or the Installation Guide for Cisco Secure ACS Solution Engine Release 4.2.
Note ACS supports UTF-8 (the 8-bit Universal Coded Character Set (UCS)/Unicode Transformation Format)
for the username and password only when authenticating with Active Directory (AD). The UTF-8 format
can preserve the full US-ASCII range, providing compatibility with the existing ASCII handling
software.
Enabling EAP-TLS Authentication
This section explains the procedures that are required to configure ACS to support EAP-TLS
authentication.
OL-14386-02