User Guide for Cisco Secure Access Control Server - Stewing Home

Windows User Database
Authentication with Windows User Databases
Trust Relationships
12-6
User Guide for Cisco Secure Access Control Server 4.2
Chapter 12 User Databases
ACS forwards user credentials to a Windows database by passing the user credentials to the Windows
operating system of the computer that is running ACS for Windows or the Solution Engine remote agent.
The Windows database passes or fails the authentication request from ACS.
ACS for Windows only: When receiving the response from the Windows database agent ACS instructs
the requesting AAA client to grant or deny the user access, depending on the response from the Windows
database.
Solution Engine only: When receiving the response from the Windows database, the remote agent
forwards the response to ACS, and ACS instructs the requesting AAA client to grant or deny the user
access, depending on the response from the Windows database.
ACS grants authorization based on the ACS group to which the user is assigned. While you can
determine the group to which a user is assigned information from the Windows database, it is ACS that
grants authorization privileges.
To further control access by a user, you can configure ACS to also check the setting for granting dial-in
permission to the user. This setting is labeled Grant dialin permission to user in Windows NT and Allow
access in the Remote Access Permission area in Windows 2000 and Windows 2003 R2. If this feature is
disabled for the user, access is denied; even if the username and password are typed correctly.
ACS can take advantage of trust relationships established between Windows domains. If the domain that
contains ACS for Windows or the computer running the Windows remote agent (ACS SE) trusts another
domain, ACS can authenticate users whose accounts reside in the other domain. ACS can also reference
the Grant dialin permission to user setting across trusted domains.
Note If ACS for Windows is running on a member server, rather than a domain controller, taking advantage
of trust relationships depends on proper configuration of ACS for Windows at installation. For more
information, see the Installation Guide for Cisco Secure ACS for Windows Release 4.2.
If the ACS SE remote agent is running on a member server, rather than a domain controller, taking
advantage of trust relationships depends on proper configuration of the remote agent at installation. For
more information, see “Configuring for Member Server Authentication” in the Installation Guide for
Cisco Secure ACS Solution Engine Release 4.2.
ACS can take advantage of indirect trusts for Windows authentication. Consider the example of
Windows domains A, B, and C, where ACS for Windows or the remote agent resides on a server in
domain A. Domain A trusts domain B, but no trust relationship is established between domain A and
domain C. If domain B trusts domain C, ACS for Windows or the remote agent in domain A can
authenticate users whose accounts reside in domain C, making use of the indirect trust of domain C.
For more information on trust relationships, refer to your Microsoft Windows documentation.
Windows Dial-Up Networking Clients
The dial-up networking clients for Windows NT/2000/2003 R2/XP Professional and Windows
95/98/Millennium Edition (ME)/XP Home enable users to connect to your network remotely; but the
fields that are provided differ:
OL-14386-02