Windows Authentication With Domain Omitted - Cisco 2509 - Router - EN User Manual

Unknown User Processing

Windows Authentication with Domain Omitted

Note
User Guide for Cisco Secure ACS for Windows Server
12-6
settings, both accounts should receive the same privileges. Regardless of whether
the user prefixes the domain name, group mapping will assign the user to the same
Cisco Secure ACS user group, because both Cisco Secure ACS user accounts
correspond to a single Windows user account.
If a domain identifier is not supplied as part of the authentication process, the
Windows operating system of the server running Cisco Secure ACS follows a
more complex authentication order that Cisco Secure ACS cannot control.
Though the order of resources used can differ, when searching for a non-domain
qualified username, Windows usually follows the order in the list below
• The local domain controller
The domain controllers in any trusted domains
•
• If Cisco Secure ACS runs on a member server, the local accounts database
Windows attempts to authenticate the user with the first account it finds whose
username matches the one passed to Windows by Cisco Secure ACS. Whether
authentication fails or succeeds, Windows does not search for other accounts with
the same username; therefore, Windows can fail to authenticate a user who
supplies valid credentials because Windows may check the supplied credentials
against the wrong account that coincidentally has an identical username.
You can circumvent this difficulty by using the Domain List in the
Cisco Secure ACS configuration for the Windows NT/2000 database. If you have
configured the Domain List with a list of trusted domains, Cisco Secure ACS
submits the username and password to each domain in the list, using a
domain-qualified format, until Cisco Secure ACS successfully authenticates the
user or until Cisco Secure ACS has tried each domain listed in the Domain List.
If your network has multiple occurrences of a username across domains (for
example, every domain has a user called Administrator) or if users dialing in do
not provide their domains as part of their authentication credentials, be sure to
configure the Domain List for the Windows NT/2000 database in the External
User Databases section. If not, only the user whose account Windows happens to
check first authenticates successfully. The Domain List is the only way that
Cisco Secure ACS controls the order in which Windows checks domains. The
Chapter 12 Administering External User Databases
78-14696-01, Version 3.1