User Guide for Cisco Secure Access Control Server - Stewing Home

Token Server User Databases
12-50
User Guide for Cisco Secure Access Control Server 4.2
Chapter 12 User Databases
Note If the primary and the secondary servers fail, ACS alternates between the servers until one
responds.
Step 8 Click Submit.
ACS saves the proxy RADIUS token server database configuration that you created. You can add it to
your Unknown User Policy or assign specific user accounts to use this database for authentication. For
more information about the Unknown User Policy, see About Unknown User Authentication, page 15-3.
For more information about configuring user accounts to authenticate by using this database, see
Chapter 6, “User Management.”
Token Server User Databases
ACS supports the use of token servers for the increased security that one-time passwords (OTPs)
provide.
This section contains:
About Token Servers and ACS, page 12-50
RADIUS-Enabled Token Servers, page 12-51
Using RSA Token-Card Client Software, page 12-54
About Token Servers and ACS
For information about the types of authentication that ACS supports with token servers, see
Authentication Protocol-Database Compatibility, page 1-8.
Requests from the AAA client are first sent to ACS. If ACS has been configured to authenticate against
a token server and finds the username, it forwards the authentication request to the token server. If it does
not find the username, ACS checks the database that is configured to authenticate unknown users. If the
request for authentication is passed, the appropriate authorizations are forwarded to the AAA client
along with the approved authentication. ACS then maintains the accounting information.
ACS for Windows Only
ACS acts as a client to the token server. For all token servers except RSA SecurID, ACS acts as a client
by using the RADIUS interface of the token server. For more information about ACS support of token
servers with a RADIUS interface, see RADIUS-Enabled Token Servers, page 12-51.
For RSA SecurID, ACS uses an RSA proprietary API. For more information about ACS support of RSA
SecurID token servers, see Using RSA Token-Card Client Software, page 12-54.
Solution Engine Only
ACS acts as a client to the token server. For all token servers, ACS acts as a client by using the RADIUS
interface of the token server. For more information about ACS support of token servers with a RADIUS
interface, see RADIUS-Enabled Token Servers, page 12-51.
OL-14386-02