User Guide for Cisco Secure Access Control Server - Stewing Home

Chapter 12 User Databases
OL-14386-02
ODBC Database (ACS for Windows Only)
Note For SQL database columns that hold user passwords, we recommend using varchar format.
If you define password columns as char, password comparison might fail if the password
does not use the full length of the field. For example, if a password column is 16 characters
wide but the password is only ten characters long, the database might append six spaces. The
value used for password comparison then grows to 16 characters, causing comparison to the
actual password that the user submitted to fail.
Microsoft SQL Server and Case-Sensitive Passwords
If you want your passwords to be case sensitive and are using Microsoft SQL Server as your
ODBC-compliant relational database, configure your SQL Server to accommodate this feature. If your
users are authenticating by using PPP via PAP or Telnet login, the password might not be case sensitive,
depending on how you set the case-sensitivity option on the SQL Server. For example, an Oracle
database will default to case sensitive, whereas Microsoft SQL Server defaults to case insensitive.
However, in the case of CHAP/ARAP, the password is case sensitive if you configured the CHAP stored
procedure.
For example, with Telnet or PAP authentication, the passwords cisco or CISCO or CiScO will all work
if you configure the SQL Server to be case insensitive.
For CHAP/ARAP, the passwords cisco or CISCO or CiScO are not the same, regardless of whether the
SQL Server is configured for case-sensitive passwords.
Sample Routine for Generating a PAP Authentication SQL Procedure
The following example routine creates a procedure named CSNTAuthUserPap in Microsoft SQL
Server, the default procedure that ACS uses for PAP authentication. Table and column names that could
vary for your database schema appear in variable text. For your convenience, the ACS product CD
includes a stub routine for creating a procedure in SQL Server or Oracle. For more information about
data type definitions, procedure parameters, and procedure results, see ODBC Database (ACS for
Windows Only), page 12-35.
if exists (select * from sysobjects where id = object_id (`dbo.CSNTAuthUserPap’) and
sysstat & 0xf = 4)drop procedure dbo.CSNTAuthUserPap
GO
CREATE PROCEDURE CSNTAuthUserPap
@username varchar(64), @pass varchar(255)
AS
SET NOCOUNT ON
IF EXISTS( SELECT username
FROM users
WHERE username = @username
AND csntpassword = @pass )
SELECT 0,csntgroup,csntacctinfo,"No Error"
FROM users
WHERE username = @username
ELSE
SELECT 3,0,"odbc","ODBC Authen Error"
GO
GRANT EXECUTE ON dbo.CSNTAuthUserPap TO ciscosecure
GO
User Guide for Cisco Secure Access Control Server 4.2
12-39