User Guide for Cisco Secure Access Control Server - Stewing Home

ODBC Database (ACS for Windows Only)
12-38
User Guide for Cisco Secure Access Control Server 4.2
Chapter 12 User Databases
Step 6 Configure ACS to authenticate users with an ODBC database. For steps, see Configuring an ODBC
External User Database, page 12-44.
Implementation of Stored Procedures for ODBC Authentication
Type Definitions
When you configure ACS to authenticate users against an ODBC-compliant relational database, you
must create a stored procedure to perform the necessary query and return the values that ACS expects.
The values that are returned and the tasks that are required of the stored procedure vary depending on
the authentication protocol used.
Authentication for PAP, or PEAP (EAP-GTC) occurs within the relational database; that is, if the stored
procedure finds a record with the username and the password matching the input, the user is considered
authenticated.
Authentication for CHAP, MS-CHAP, ARAP, LEAP, or EAP-MD5 occurs within ACS. The stored
procedure returns the fields for the record with a matching username, including the password. ACS
confirms or denies authentication based on the values that are returned from the procedure.
Authentication for EAP-TLS occurs within ACS. The stored procedure returns the field for the record,
indicating whether it found the username in the ODBC database. ACS confirms or denies authentication
based on the values that are returned from the procedure and on the validity of the user certificate. For
more information about ACS support for the EAP-TLS protocol, see EAP-TLS Authentication, page 9-2.
To support the three sets of protocols, ACS provides different input to, and expects different output from,
the ODBC authentication request. This feature requires a separate stored procedure in the relational
database to support each of the three sets of protocols.
The ACS product CD contains stub routines for creating a procedure in Microsoft SQL Server or an
Oracle database. You can modify a copy of these routines to create your stored procedure or write your
own. You can see example routines for creating PAP and CHAP/MS-CHAP/ARAP authentication stored
procedures in SQL Server in Sample Routine for Generating a PAP Authentication SQL Procedure,
page 12-39, and Sample Routine for Generating an SQL CHAP Authentication Procedure, page 12-40.
The following sections provide reference information about ACS data types versus SQL data types,
PAP/PEAP (EAP-GTC) authentication procedure input and output, CHAP/MS-CHAP/ARAP
authentication procedure input and output, EAP-TLS authentication procedure input and output, and
expected result codes. You can use this information while writing your authentication stored procedures
in your relational database.
Note Two stored procedures are required when using EAP-FAST; MS-CHAP (used for phase zero
provisioning) and PAP (used for phase two authentication).
The ACS types and their matching SQL types are:
Integer—SQL_INTEGER
String—SQL_CHAR or SQL_VARCHAR
OL-14386-02