User Guide for Cisco Secure Access Control Server - Stewing Home

ODBC Database (ACS for Windows Only)
CHAP/MS-CHAP/ARAP Procedure Output
12-42
User Guide for Cisco Secure Access Control Server 4.2
Chapter 12 User Databases
The stored procedure must return a single row that contains the nonnull fields.
Table 12-4 lists the procedure results that ACS expects as output from a stored procedure.
Table 12-4 CHAP/MS-CHAP/ARAP Stored Procedure Results
Field Type Explanation
CSNTresult Integer See Table 12-7 Result Codes.
CSNTgroup Integer The ACS group number for authorization. You use 0xFFFFFFFF to assign the default value.
Values other than 0-499 are converted to the default.
Note The group that is specified in the CSNTgroup field overrides group mapping that is
configured for the ODBC external user database.
CSNTacctInfo String 0-15 characters. A customer-defined string that ACS adds to subsequent account log file
entries.
CSNTerrorString String 0-255 characters. A customer-defined string that ACS writes to the CSAuth service log file if
an error occurs.
CSNTpassword String 0-255 characters. ACS authenticates the password.
Note If the password field in the database is defined by using a char datatype rather than
varchar, the database might return a string that is 255 characters long; regardless of
actual password length. We recommend using the varchar datatype for the CHAP
password field in your ODBC database.
The CSNTGroup and CSNTacctInfo fields are processed only after a successful authentication. The
CSNTerrorString file is logged only after a failure (if the result is greater than or equal to 4).
Note If the ODBC database returns data in recordset format rather than in parameters, the procedure must
return the result fields in the order previously listed.
EAP-TLS Authentication Procedure Input
ACS provides a single value for input to the stored procedure that supports EAP-TLS authentication. The
stored procedure should accept the named input value as a variable.
Note Because ACS performs authentication for EAP-TLS, the user password is not an input (Table 12-3).
Table 12-5 EAP-TLS Stored Procedure Input
Field Type Explanation
CSNTusername String 0-64 characters
The input name is for guidance only. A procedure variable that is created from it can have a different
name.
OL-14386-02