User Guide for Cisco Secure Access Control Server - Stewing Home

Windows User Database
12-8
User Guide for Cisco Secure Access Control Server 4.2
Chapter 12 User Databases
At symbol (@)
Backslash (\)
Based on the presence and position of these two characters in the username, ACS determines username
format by using the following logic:
1. If the username does not contain a backslash (\) and does not contain an at symbol (@), ACS
considers the username to be nondomain qualified. For example, the username cyril.yang is
nondomain qualified. For more information, see Nondomain-Qualified Usernames, page 12-8.
2. If the username contains a backslash (\) that precedes any at characters, ACS considers the username
to be domain qualified. For example, ACS considers the following usernames to be domain
qualified:
– MAIN\cyril.yang
– MAIN\cyril.yang@central-office
For more information, see Domain-Qualified Usernames, page 12-9.
3. If the username contains an at symbol (@) that does not follow a backslash (\), ACS considers the
username to be in User Principal Name (UPN) format. For example, ACS considers the following
usernames to be UPN usernames:
– cyril.yang@example.com
– cyril.yang@main.example.com
– cyril.yang@main
Nondomain-Qualified Usernames
– cyril.yang@central-office@example.com
– cyril.yang@main\example.com
For more information, see UPN Usernames, page 12-9.
ACS supports Windows authentication of usernames that are not domain qualified, provided the
username does not contain an at symbol (@). Users with at symbols (@) in their usernames must submit
the username in UPN format or in a domain-qualified format. Examples of nondomain-qualified
usernames are cyril.yang and msmith.
In Windows environments with multiple domains, authentication results with nondomain-qualified
usernames can vary. This variance occurs because Windows, not ACS, determines which domains are
used to authenticate a nondomain-qualified username. If Windows does not find the username in its local
domain database, it then checks all trusted domains. If ACS for Windows or the remote agent runs on a
member server and the username is not found in trusted domains, Windows also checks its local accounts
database. Windows attempts to authenticate a user with the first occurrence of the username that it finds.
When Windows authentication for a nondomain-qualified username succeeds, the privileges that are
assigned during authentication will be those that are associated with the Windows user account in the
first domain with a matching username and password. This condition also illustrates the importance of
removing usernames from a domain when the user account is no longer needed.
Note If the credentials that the user submits do not match the credentials that are associated with the first
matching username that Windows finds, authentication fails. Thus, if different users in different domains
share the same exact username, logging in with a nondomain-qualified username can result in
inadvertent authentication failure.
OL-14386-02