User Guide for Cisco Secure Access Control Server - Stewing Home

Chapter 12 User Databases
OL-14386-02
User Guide for Cisco Secure Access Control Server 4.2
Generic LDAP
A cached DN cannot appear on a screen. If a bind to a cached DN fails, ACS falls back to a full search
of the data base for authenticating a user.
LDAP Configuration Options
The LDAP Database Configuration page contains many options, presented in three tables:
Domain Filtering—This table contains options for domain filtering. The settings in this table affect
all LDAP authentication that is performed by using this configuration; regardless of whether the
primary or secondary LDAP server handles the authentication. For more information about domain
filtering, see Domain Filtering, page 12-24
This table contains:
– Process all usernames—When you select this option, ACS does not perform domain filtering
on usernames before submitting them to the LDAP server for authentication.
– Only process usernames that are domain qualified—When you select this option, ACS only
attempts authentication for usernames that are domain-qualified for a single domain. You must
specify the type of domain qualifier and the domain in the Qualified by and Domain options.
ACS only submits usernames that are qualified in the method that you specify in the Qualified
by option and that are qualified with the username that is specified in the Domain Qualifier box.
You can also specify whether ACS removes the domain qualifier from usernames before
submitting them to an LDAP server.
– Qualified by—When you select Only process usernames that are domain qualified, this
option specifies the type of domain qualification. If you select Prefix, ACS only processes
usernames that begin with the characters that you specify in the Domain Qualifier box. If you
select Suffix, ACS only processes usernames that end in the characters that you specify in the
Domain Qualifier box.
Note Regardless of the domain qualifier type that is selected, the domain name must match the domain
that is specified in the Domain Qualifier box.
– Domain Qualifier—When Only process usernames that are domain qualified is selected, this
option specifies the domain name and delimiting character that must qualify usernames so ACS
can submit the username to an LDAP server. The Domain box accepts up to 512 characters;
however, only one domain name and its delimiting character are permitted.
For example, if the domain name is mydomain, the delimiting character is the at symbol (@),
and Suffix is selected on the Qualified by list, the Domain box should contain @mydomain. If
the domain name is yourdomain, the delimiting character is the backslash (\), and Prefix is
selected on the Qualified by list, the Domain Qualifier box should contain yourdomain\.
– Strip domain before submitting username to LDAP server—When you select Only process
usernames that are domain qualified, this option specifies whether ACS removes the domain
qualifier and its delimiting character before submitting a username to an LDAP server. For
example, if the username is jwiedman@domain.com, the stripped username is jwiedman.
– Process all usernames after stripping domain name and delimiter—When this option is
selected, ACS submits all usernames to an LDAP server after attempting to strip domain names.
Usernames that are not domain qualified are processed, too. Domain name stripping occurs as
specified by the following two options:
12-27