User Guide for Cisco Secure Access Control Server - Stewing Home

Chapter 14 Network Access Profiles
Authentication Policy Configuration for NAPs
Credential Validation Databases
OL-14386-02
Configuring Policies for Profiles
Authentication settings define which databases are used to validate the credentials of the user for
authentication. Before you configure authentication policies configure the External User Databases that
you mapped to ACS user groups by the mapping rules that are defined in Database Group Mapping.
Note The ACS internal database is the default selected database.
You can also configure Agentless Request Processing for MAC addresses as part of your authentication
policy. For more information, see Agentless Request Processing, page 14-24.
These topics describe how to configure authentication settings:
Credential Validation Databases, page 14-27
Group Filtering at NAP Level, page 14-27
Object Identifier Check for EAP-TLS Authentication, page 14-28
Configuring Authentication Policies, page 14-28
The Credential Validation Databases are databases that you use to validate users. The Available
Databases are the configured External User Databases that are mapped to ACS user groups by the
mapping rules defined in Databases Group Mapping. The ACS internal database appears, by default, as
a selected database.
Note If you specify multiple databases for authentication, ACS will query each directory server in the order
specified until it receives an authoritative response. You should put the most likely directory servers
higher in the list to improve response times and user experience.
Group Filtering at NAP Level
You can use ACS to perform group filtering at the NAP level. Depending on the user’s external database
group membership, ACS can reject or accept access to the network based on the group filtering settings.
Group filtering indicates the expected group membership in an external LDAP database. For example, if
the group filter for the NAP is configured as LDAP_GRP1, LDAP_GRP2, the user must belong to any
one of these groups in LDAP to authenticate successfully.
Group filtering is checked while performing group mapping during external database authentication.
Note Group filtering occurs at the NAP level and cannot be used as a NAP selection criteria, since a user's
external database membership is still unknown during the NAP selection processing.
Note This feature is based at the NAP level only for RADIUS authentications, since NAPs are applicable only
for RADIUS packet processing.
User Guide for Cisco Secure Access Control Server 4.2
14-27