External User Database Authentication Process - Cisco 2509 - Router - EN User Manual

About External User Databases

External User Database Authentication Process

User Guide for Cisco Secure ACS for Windows Server
11-6
After you have configured Cisco Secure ACS to communicate with an external
user database, you can configure Cisco Secure ACS to authenticate users with the
external user database in one of two ways:
By Specific User Assignment—You can configure Cisco Secure ACS to
•
authenticate specific users with an external user database. To do this, the user
must exist in the CiscoSecure user database and the Password Authentication
list in User Setup must be set to the external user database that
Cisco Secure ACS should use to authenticate the user.
While setting the Password Authentication for every user account is time
consuming, this method of determining which users are authenticated with an
external user database is secure because it requires explicit definition of who
should authenticate using the external user database. In addition, the users
may be placed in the desired Cisco Secure ACS group and thereby receive the
applicable access profile.
By Unknown User Policy—You can configure Cisco Secure ACS to attempt
•
authentication of users not found in the CiscoSecure user database by using
an external user database. Users do not need to be defined in the CiscoSecure
user database for this method. For more information about the Unknown User
Policy, see Unknown User Processing, page
You can also configure Cisco Secure ACS with both methods above; these two
methods are not mutually exclusive.
When Cisco Secure ACS attempts user authentication with an external user
database, it forwards the user credentials to the external user database. The
external user database either passes or fails the authentication request from
Cisco Secure ACS. Upon receiving the response from the external user database,
Cisco Secure ACS instructs the requesting AAA client to grant or deny the user
access, depending upon the response from the external user database.
The specifics of the method used to communicate with the external user database
vary with the database type. For LDAP and Novell NDS, Cisco Secure ACS uses
TCP connections. For Windows NT/2000 user databases, Cisco Secure ACS uses
the authentication API provided in the Windows operating system. With the
exception of RSA token servers, Cisco Secure ACS communicates with token
servers using RADIUS. For RSA token servers, Cisco Secure ACS acts an RSA
client in order to use the RSA proprietary interface.
Chapter 11 Working with User Databases
12-1.
78-14696-01, Version 3.1