Chapter 11 Working with User Databases
Generic LDAP
11-18
User Guide for Cisco Secure ACS for Windows Server
78-14696-01, Version 3.1
Cisco Secure ACS does not require that each LDAP instance corresponds to a
unique LDAP database. You can have more than one LDAP configuration set to
access the same database. This is useful when your LDAP database contains more
than one subtree for users or groups. Because each LDAP configuration supports
only one subtree directory for users and one subtree directory for groups, you
must configure separate LDAP instances for each user directory subtree and group
directory subtree combination for which Cisco Secure ACS should submit
authentication requests.
For each LDAP instance, you can add or leave it out of the Unknown User Policy.
For more information, see
Unknown User Processing, page 12-1
.
For each LDAP instance, you can establish unique group mapping. For more
information, see
Group Mapping by Group Set Membership, page 12-14
.
Multiple LDAP instances is also important when you use domain filtering. For
more information, see
Domain Filtering, page 11-18
.
LDAP Organizational Units and Groups
LDAP groups do not need to have the same name as their corresponding
Cisco Secure ACS groups. The LDAP group can be mapped to a
Cisco Secure ACS group with any name you want to assign. For more information
about how your LDAP database handles group membership, see your LDAP
database documentation. For more information on LDAP group mappings and
Cisco Secure ACS, see
Database Group Mappings, page 12-11
.
Domain Filtering
Using domain filtering, you can control which LDAP instance is used to
authenticate a user based on domain-qualified usernames. Domain filtering is
based on parsing the characters either at the beginning or end of a username
submitted for authentication. Domain filtering provides you with greater control
over the LDAP instance that Cisco Secure ACS submits any given user
authentication request to. You also have control of whether usernames are
submitted to an LDAP server with their domain qualifiers intact.
For example, when EAP-TLS authentication is initiated by a Windows XP client,
Cisco Secure ACS receives the username in
username@domainname
format. When
PEAP authentication is initiated by a Cisco Aironet end-user client,
