User Guide for Cisco Secure Access Control Server - Stewing Home

Generic LDAP
12-30
User Guide for Cisco Secure Access Control Server 4.2
Chapter 12 User Databases
– LDAP Version—ACS uses LDAP version 3 or version 2 to communicate with your LDAP
database. If you check this check box, ACS uses LDAP version 3. If it is not checked, ACS uses
LDAP version 2.
– Security—ACS uses SSL to encrypt communication between ACS and the LDAP server. If you
do not enable SSL, user credentials are passed to the LDAP server in clear text. If you select
this option, then you must select Trusted Root CA or Certificate Database Path. ACS
supports only server-side authentication for SSL communication with the LDAP server.
Solution Engine only: You must be sure that the Port box contains the port number used for SSL
on the LDAP server.
– Trusted Root CA—LDAP over SSL includes the option to authenticate by using the certificate
database files other than the Netscape cert7.db file. This option uses the same mechanism as
other SSL installations in the ACS environment. Select the certification authority that issued the
server certificate that is installed on the LDAP server.
– Certificate DB Path—Uses the path to the Netscape cert7.db file, which contains the
certificates for the server to be queried, and the certificates for the trusted CA.
ACS for Windows
ACS SE
– The path to the Netscape cert7.db file. This file must contain the certificates for the server to be
queried and the trusted CA. You can use a Netscape web browser to generate cert7.db files. For
information about generating a cert7.db file, refer to Netscape documentation.
To perform secure authentication by using SSL with this option, you must provide a Netscape
cert7.db certificate database file. ACS requires a certificate database so that it can establish the
SSL connection because the certificate database must be local to the ACS Windows server.
– This option provides a link to the Download Certificate Database page. ACS displays
information about whether the Netscape cert7.db certificate database file has been downloaded
to support secure communication to the LDAP server that you specified. For information about
the Download Certificate Database page, see Downloading a Certificate Database (Solution
Engine Only), page 12-47.
To perform secure authentication by using SSL with this option, you must provide a Netscape
cert7.db certificate database file. ACS requires a certificate database so that it can establish the
SSL connection. Since the certificate database must be local to the Solution Engine, you must
use FTP to transfer the certificate database to ACS.
ACS requires a cert7.db certificate database file for each LDAP server that you configure. For
example, to support users distributed in multiple LDAP trees, you might configure two LDAP
instances in ACS that can communicate with the same LDAP servers. Each LDAP instance then
has a primary and a secondary LDAP server. Even though the two LDAP configurations share
the same primary server, each LDAP configuration requires that you download a certificate
database file to ACS.
Note The database must be a Netscape cert7.db certificate database file. No other filename is
supported.
Caution TACACS+ authentications to the back-end LDAP database may not work properly when ACS is
operating under a heavy load by using cert7.db. TACACS+ services may shut down and authentications
cease. The third-party DLL may be unstable and cause exceptions. In addition, Netscape no longer
OL-14386-02