User Guide for Cisco Secure Access Control Server - Stewing Home

Generic LDAP
Successful Previous Authentication with the Primary LDAP Server
12-26
User Guide for Cisco Secure Access Control Server 4.2
Chapter 12 User Databases
If, on the previous LDAP authentication attempt, ACS successfully connected to the primary LDAP
server, ACS attempts to connect to the primary LDAP server. If ACS cannot connect to the primary
LDAP server, ACS attempts to connect to the secondary LDAP server.
If ACS cannot connect with LDAP server, ACS stops attempting LDAP authentication for the user. If the
user is an unknown user, ACS tries the next external user database in the Unknown User Policy list. For
more information about the Unknown User Policy list, see About Unknown User Authentication,
page 15-3.
Unsuccessful Previous Authentication with the Primary LDAP Server
If, on the previous LDAP authentication attempt, ACS could not connect to the primary LDAP server,
whether ACS first attempts to connect to the primary server or secondary LDAP server for the current
authentication attempt depends on the value in the Failback Retry Delay box. If the Failback Retry Delay
box is set to zero (0), ACS always attempts to connect to the primary LDAP server first. And if ACS
cannot connect to the primary LDAP server, ACS then attempts to connect to the secondary LDAP
server.
If the Failback Retry Delay box is set to a number other than zero (0), ACS determines how many
minutes have passed since the last authentication attempt by using the primary LDAP server. If more
minutes have passed than the value in the Failback Retry Delay box, ACS attempts to connect to the
primary LDAP server first. And if ACS cannot connect to the primary LDAP server, ACS then attempts
to connect to the secondary LDAP server.
If fewer minutes have passed than the value in the Failback Retry Delay box, ACS attempts to connect
to the secondary LDAP server first. And if ACS cannot connect to the secondary LDAP server, ACS then
attempts to connect to the primary LDAP server.
If ACS cannot connect to either LDAP server, ACS stops attempting LDAP authentication for the user.
If the user is an unknown user, ACS tries the next external user database in the Unknown User Policy
list. For more information about the Unknown User Policy list, see About Unknown User
Authentication, page 15-3.
LDAP Admin Logon Connection Management
When ACS checks authentication and authorization of a user on an LDAP server, it uses a connection
with the LDAP administrator account permissions. It uses the connection to search for the user and user
groups on the Directory subtree. ACS retains the administrator connections that are open for successive
use and additional administrator binds are not required for each authentication request. You can limit the
maximum number of concurrent administrator connections per Generic LDAP External DB
configuration (primary and secondary).
Distinguished Name Caching
Searching can be an expensive LDAP operation, which introduces an element of unpredictability into
the authentication. ACS takes the username that the authentication process supplies, and asks the LDAP
server to search a full subtree of unknown depth, over an unknown user population.
After successful authentication ACS caches the Distinguished Name (DN) that the search returns.
Reauthentications can then use the cached DN to perform an immediate lookup of the user.
OL-14386-02