User Guide for Cisco Secure Access Control Server - Stewing Home

ODBC Database (ACS for Windows Only)
12-36
Sample Routine for Generating a PAP Authentication SQL Procedure, page 12-39
User Guide for Cisco Secure Access Control Server 4.2
Chapter 12 User Databases
Sample Routine for Generating an SQL CHAP Authentication Procedure, page 12-40
Sample Routine for Generating an EAP-TLS Authentication Procedure, page 12-40
PAP Authentication Procedure Input, page 12-40
PAP Procedure Output, page 12-41
CHAP/MS-CHAP/ARAP Authentication Procedure Input, page 12-41
CHAP/MS-CHAP/ARAP Procedure Output, page 12-42
EAP-TLS Authentication Procedure Input, page 12-42
EAP-TLS Procedure Output, page 12-43
Result Codes, page 12-43
Configuring a System Data Source Name for an ODBC External User Database, page 12-44
Configuring an ODBC External User Database, page 12-44
What is Supported with ODBC User Databases
ACS supports the use of ODBC external user databases for:
Authentication—For information about the types of authentication that ACS supports by using a
relational database via the ODBC authenticator feature, see Authentication Protocol-Database
Compatibility, page 1-8.
Group Specification—ACS supports group assignment for users who are authenticated by an
ODBC user database. Authentication queries to the ODBC database must contain the group number
to which you want to assign a user. For unknown users authenticated by an ODBC user database,
group specification overrides group mapping.
For more information about expected query output, see PAP Procedure Output, page 12-41,
CHAP/MS-CHAP/ARAP Procedure Output, page 12-42, and EAP-TLS Procedure Output,
page 12-43.
Group Mapping for Unknown Users—ACS supports group mapping for unknown users by
requesting group membership information from Windows user databases. For more information
about group mapping for users who are authenticated with a Windows user database, see Group
Mapping by Group Set Membership, page 16-3.
ACS Authentication Process with an ODBC External User Database
ACS forwards user authentication requests to an ODBC database when the user:
Account in the ACS internal database lists an ODBC database configuration as the authentication
method.
Is unknown to the ACS internal database, and the Unknown User Policy dictates that an ODBC
database is the next external user database to try.
In either case, ACS forwards user credentials to the ODBC database via an ODBC connection. The
relational database must have a stored procedure that queries the appropriate tables and returns values
to ACS. If the returned values indicate that the user credentials that were provided are valid, ACS
instructs the requesting AAA client to grant the user access; otherwise, ACS denies the user access
(Figure 12-2).
OL-14386-02