User Guide for Cisco Secure Access Control Server - Stewing Home

Chapter 12 User Databases
EAP-TLS Procedure Output
Result Codes
OL-14386-02
ODBC Database (ACS for Windows Only)
The stored procedure must return a single row that contains the nonnull fields.
Table 12-4 lists the procedure results that ACS expects as output from stored procedure.
Table 12-6 EAP-TLS Stored Procedure Results
Field Type Explanation
CSNTresult Integer See Table 12-7 Result Codes.
CSNTgroup Integer The ACS group number for authorization. You use 0xFFFFFFFF to assign the default value.
Values other than 0-499 are converted to the default.
Note The group that is specified in the CSNTgroup field overrides group mapping that is
configured for the ODBC external user database.
CSNTacctInfo String 0-15 characters. A customer-defined string that ACS adds to subsequent account log file entries.
CSNTerrorString String 0-255 characters. A customer-defined string that ACS writes to the CSAuth service log file if an
error occurs.
The CSNTGroup and CSNTacctInfo fields are processed only after a successful authentication. The
CSNTerrorString file is logged only after a failure (if the result is greater than or equal to 4).
Note If the ODBC database returns data in recordset format, rather than in parameters, the procedure must
return the result fields in the order previously listed.
You can set the result codes that are listed in Table 12-7.
Table 12-7 Result Codes
Result Code Meaning
0 (zero) Authentication successful
1 Unknown username
2 Invalid password
3 Unknown username or invalid password
4+ Internal error—authentication not processed
The SQL procedure can decide among 1, 2, or 3 to indicate a failure, depending on how much
information that you want the failed authentication log files to include.
A return code of 4 or higher results in an authentication error event. These errors do not increment
per-user failed attempt counters. Additionally, error codes are returned to the AAA client so it can
distinguish between errors and failures and, if configured to do so, fall back to a backup AAA server.
Successful or failed authentications are not logged; general ACS logging mechanisms apply. In the event
of an error (CSNTresult equal to or less than 4), the contents of the CSNTerrorString are written to the
Windows Event Log under the Application Log.
User Guide for Cisco Secure Access Control Server 4.2
12-43