User Guide for Cisco Secure Access Control Server - Stewing Home

ACS Internal Database
About the ACS Internal Database
User Import and Creation
12-2
User Guide for Cisco Secure Access Control Server 4.2
Chapter 12 User Databases
For users who are authenticated by using the ACS internal database, ACS stores user passwords in a
database which is protected by an administration password and encrypted by using the AES 128
algorithm. For users who are authenticated with external user databases, ACS does not store passwords
in the ACS internal database.
Unless you have configured ACS to authenticate users with an external user database, ACS uses
usernames and passwords in the ACS internal database during authentication. For more information
about specifying an external user database for authentication of a user, see Adding a Basic User Account,
page 6-3.
The following facilities can import or create user accounts:
RDBMS Synchronization—You can use RDBMS Synchronization to create large numbers of user
accounts and configure many settings for user accounts. RDBMS also supports import of user
accounts from external sources. We recommend that you use this feature whenever you need to
import users by bulk; however, setting up RDBMS Synchronization for the first time requires several
important decisions and time to implement them. For more information, see RDBMS
Synchronization, page 8-17.
CSUtil.exe (ACS for Windows)—The CSUtil.exe command-line utility provides a simple means of
creating basic user accounts. CSUtil.exe also supports import of user accounts from external
sources. When compared to RDBMS Synchronization, its functionality is limited; however, it is
simple to prepare for importing basic user accounts and assigning users to groups. For more
information, see Appendix C, “CSUtil Database Utility.”
The following facilities can create user accounts:
ACS web interface—The web interface provides the ability to create user accounts manually, one
user at a time. Regardless of how a user account was created, you can edit a user account by using
the web interface. For detailed steps, see Adding a Basic User Account, page 6-3.
Unknown User Policy—The Unknown User Policy enables ACS to add users automatically when
it finds a user without an account in an external user database. The creation of a user account in ACS
occurs only when the user attempts to access the network and is successfully authenticated by an
external user database. For more information, see Chapter 15, “Unknown User Policy.”
If you use the Unknown User Policy, you can also configure group mappings so that each time a user
who was added to ACS by the Unknown User Policy is authenticated, the user group assignment is
made dynamically. For some external user database types, user group assignment is based on group
membership in the external user database. For other database types, all users who were authenticated
by a given database are assigned to a single ACS user group. For more information about group
mapping, see Chapter 16, “User Group Mapping and Specification.”
Database Replication—Database Replication creates user accounts on a secondary ACS by
overwriting all existing user accounts on a secondary ACS with the user accounts from the primary
ACS. Any user accounts that are unique to a secondary ACS are lost in the replication. For more
information, see ACS Internal Database Replication, page 8-1.
OL-14386-02