Cisco 3.3 User Manual page 512

Windows User Database
User Guide for Cisco Secure ACS for Windows Server
13-28
The check boxes under MS CHAP Settings do no affect password
Note
aging for Microsoft PEAP, EAP-FAST, or machine authentication.
For more information about Windows password changes, see
Password Aging for Users in Windows Databases, page
• Enable password change inside PEAP or EAP-FAST—The Permit
password change inside PEAP or EAP-FAST check box controls whether
Cisco Secure ACS supports PEAP-based or EAP-FAST-based password
changes for Windows user accounts. PEAP password changes are supported
only when the end-user client uses PEAP(EAP-MSCHAPv2) for user
authentication. For EAP-FAST, Cisco Secure ACS supports password
changes in phase zero and phase two.
EAP-TLS Strip Domain Name—The EAP-TLS Strip Domain Name check
•
box controls whether Cisco Secure ACS removes the domain name from a
username derived from the Subject Alternative Name (SAN) field in an
end-user certificate.
Performing domain name stripping can speed EAP-TLS authentication when
the domain that must authenticate a user is not the domain represented in the
SAN field. For example, a user's SAN field may contain
"jsmith@corporation.com" but jsmith may need to authenticate using the
domain controller for a subdomain named "engineering". Stripping
"@corporation.com" from the username eliminates the needless attempt at
authenticating jsmith against the corporation.com domain controller. Without
stripping the domain name, only after jsmith cannot be found in
corporation.com will Cisco Secure ACS use the Domain List and find the user
in the engineering domain. The additional delay could be several seconds.
Enable PEAP machine authentication—This check box controls whether
•
Cisco Secure ACS performs machine authentication using machine name and
password with PEAP(EAP-MSCHAPv2). For more information about
machine authentication, see
Enable EAP-TLS machine authentication—This check box controls
•
whether Cisco Secure ACS performs machine authentication using machine
name and password with EAP-TLS. For more information about machine
authentication, see
Machine Authentication, page
Machine Authentication, page
Chapter 13 User Databases
Enabling
6-26.
13-16.
13-16.
78-16592-01