User Guide for Cisco Secure Access Control Server - Stewing Home

Chapter 12 User Databases
OL-14386-02
o=corporation.com
or
dc=corporation,dc=com
User Guide for Cisco Secure Access Control Server 4.2
Generic LDAP
as applicable to your LDAP configuration. For more information, refer to your LDAP database
documentation.
– UserObjectType—The name of the attribute in the user record that contains the username. You
can obtain this attribute name from your Directory Server. For more information, refer to your
LDAP database documentation. ACS contains default values that reflect the default
configuration of a Netscape Directory Server. Confirm all values for these fields with your
LDAP server configuration and documentation.
– UserObjectClass—The value of the LDAP objectType attribute that identifies the record as a
user. Often, user records have several values for the objectType attribute, some of which are
unique to the user, some of which are shared with other object types. This box should contain a
value that is not shared.
– GroupObjectType—The name of the attribute in the group record that contains the group
name.
– GroupObjectClass—A value of the LDAP objectType attribute in the group record that
identifies the record as a group.
– Group Attribute Name—The name of the attribute of the group record that contains the list of
user records that are a member of that group.
– Server Timeout—The number of seconds that ACS waits for a response from an LDAP server
before determining that the connection with that server has failed.
– On Timeout Use Secondary—Determines whether ACS performs failover of LDAP
authentication attempts. For more information about the LDAP failover feature, see LDAP
Failover, page 12-25.
– Failback Retry Delay—The number of minutes after the primary LDAP server fails to
authenticate a user that ACS resumes sending authentication requests to the primary LDAP
server first. A value of zero (0) causes ACS to always use the primary LDAP server first.
– Max. Admin Connections—The maximum number of concurrent connections (greater than
zero (0)) with LDAP administrator account permissions that can run for a specific LDAP
configuration. These connections are used to search the Directory for users and groups under
the User Directory Subtree and Group Directory Subtree.
Primary and Secondary LDAP Servers—You can use the Primary LDAP Server table and the
Secondary LDAP Server table to identify the LDAP servers and make settings that are unique to
each. You do not need to complete the Secondary LDAP Server table if you do not intend to use
LDAP failover.
These tables contain:
– Hostname—The name or IP address of the server that is running the LDAP software. If you are
using DNS on your network, you can type the hostname instead of the IP address.
– Port—The TCP/IP port number on which the LDAP server is listening. The default is 389, as
stated in the LDAP specification. If you do not know the port number, you can find this
information by viewing those properties on the LDAP server. If you want to use secure
authentication, port 636 is usually used.
12-29