Ldap Organizational Units And Groups; Domain Filtering - Cisco 2509 - Router - EN User Manual

Generic LDAP

LDAP Organizational Units and Groups

Domain Filtering

User Guide for Cisco Secure ACS for Windows Server
11-18
Cisco Secure ACS does not require that each LDAP instance corresponds to a
unique LDAP database. You can have more than one LDAP configuration set to
access the same database. This is useful when your LDAP database contains more
than one subtree for users or groups. Because each LDAP configuration supports
only one subtree directory for users and one subtree directory for groups, you
must configure separate LDAP instances for each user directory subtree and group
directory subtree combination for which Cisco Secure ACS should submit
authentication requests.
For each LDAP instance, you can add or leave it out of the Unknown User Policy.
For more information, see
For each LDAP instance, you can establish unique group mapping. For more
information, see Group Mapping by Group Set Membership, page
Multiple LDAP instances is also important when you use domain filtering. For
more information, see
LDAP groups do not need to have the same name as their corresponding
Cisco Secure ACS groups. The LDAP group can be mapped to a
Cisco Secure ACS group with any name you want to assign. For more information
about how your LDAP database handles group membership, see your LDAP
database documentation. For more information on LDAP group mappings and
Cisco Secure ACS, see
Using domain filtering, you can control which LDAP instance is used to
authenticate a user based on domain-qualified usernames. Domain filtering is
based on parsing the characters either at the beginning or end of a username
submitted for authentication. Domain filtering provides you with greater control
over the LDAP instance that Cisco Secure ACS submits any given user
authentication request to. You also have control of whether usernames are
submitted to an LDAP server with their domain qualifiers intact.
For example, when EAP-TLS authentication is initiated by a Windows XP client,
Cisco Secure ACS receives the username in
PEAP authentication is initiated by a Cisco Aironet end-user client,
Unknown User Processing, page
Domain Filtering, page
Database Group Mappings, page
username@domainname
Chapter 11 Working with User Databases
12-1.
11-18.
12-11.
78-14696-01, Version 3.1
12-14.
format. When