User Guide for Cisco Secure Access Control Server - Stewing Home

Chapter 12 User Databases
Generic LDAP
OL-14386-02
User Guide for Cisco Secure Access Control Server 4.2
Generic LDAP
User authentication between multiple forests is supported for EAP-FASTv1a with PEAP, MSPEAP, and
for EAP-TLS.
Note The multi-forest feature works only when the username contains the domain information.
For information about the types of authentication that ACS supports with generic LDAP databases, such
as Netscape Directory Services, see Authentication Protocol-Database Compatibility, page 1-8.
ACS supports group mapping for unknown users by requesting group membership information from
LDAP user databases. For more information about group mapping for users who are authenticated with
an LDAP user database, see Group Mapping by Group Set Membership, page 16-3.
Configuring ACS to authenticate against an LDAP database has no effect on the configuration of the
LDAP database. To manage your LDAP database, see your LDAP database documentation.
This section contains:
ACS Authentication Process with a Generic LDAP User Database, page 12-23
Multiple LDAP Instances, page 12-24
LDAP Organizational Units and Groups, page 12-24
Domain Filtering, page 12-24
LDAP Failover, page 12-25
LDAP Admin Logon Connection Management, page 12-26
Distinguished Name Caching, page 12-26
LDAP Configuration Options, page 12-27
Configuring a Generic LDAP External User Database, page 12-31
Downloading a Certificate Database (Solution Engine Only), page 12-47
ACS Authentication Process with a Generic LDAP User Database
ACS forwards the username and password to an LDAP database by using a Transmission Control
Protocol (TCP) connection on a port that you specify. The LDAP database passes or fails the
authentication request from ACS. When receiving the response from the LDAP database, ACS instructs
the requesting AAA client to grant or deny the user access, depending on the response from the LDAP
server.
ACS grants authorization based on the ACS group to which the user is assigned. While the group to
which a user is assigned can be determined by information from the LDAP server, ACS grants
authorization privileges.
12-23