12-3
User Guide for Cisco Secure ACS for Windows Server
78-14696-01, Version 3.1
Chapter 12 Administering External User Databases
Unknown User Processing
the user account contains only the username, a Password Authentication list
setting that reflects the external user database that authenticated the user, and
a “Group to which the user is assigned” list setting of Mapped By External
Authenticator, which enables group mapping. Using the Cisco Secure ACS
HTML interface, you can further configure the user account as needed. For
example, after a discovered user is created in Cisco Secure ACS, you can
assign user-specific network access restrictions to the discovered user.
Note
Cisco Secure ACS does not import passwords for a discovered user;
rather, Cisco Secure ACS creates the user account with the Password
Authentication list set to the external user database that originally
authenticated the user.
All discovered users were once unknown users. The authentication process
for discovered users is identical to the authentication process for known users
who are authenticated with external user databases and whose
Cisco Secure ACS group membership is determined by group mapping.
Note
We recommend removing a username from a database when the privileges
associated with that username are no longer required.
General Authentication Request Handling and Rejection Mode
If you have configured the Unknown User Policy in Cisco Secure ACS,
Cisco Secure ACS attempts to authenticate users as follows:
1.
Cisco Secure ACS checks its internal user database. If the user exists in the
CiscoSecure user database (that is, is a known or discovered user),
Cisco Secure ACS tries to authenticate the user with the specified password
type against the specified database. Authentication for that user either passes
or fails, depending on other procedures in the normal authentication process.
2.
If the user does not exist in the CiscoSecure user database (that is, is an
unknown user), Cisco Secure ACS tries each configured external database in
the order specified in the Selected Databases list. If the user passes
authentication against one of the external databases, Cisco Secure ACS
automatically adds the user to the CiscoSecure user database, with a pointer