11-41
User Guide for Cisco Secure ACS for Windows Server
78-14696-01, Version 3.1
Chapter 11 Working with User Databases
ODBC Database
For more information about expected query output, see
PAP Procedure
Output, page 11-47
, and
CHAP/MS-CHAP/ARAP Procedure Output,
page 11-48
.
•
Group Mapping for Unknown Users—Cisco Secure ACS supports group
mapping for unknown users by requesting group membership information
from Windows user databases. For more information about group mapping
for users authenticated with a Windows user database, see
Group Mapping by
Group Set Membership, page 12-14
.
Cisco Secure ACS Authentication Process with an ODBC
External User Database
Cisco Secure ACS forwards user authentication requests to an ODBC database in
either of the two following scenarios. The first scenario is when the user account
in the CiscoSecure user database lists an ODBC database configuration as the
authentication method. The second is when the user is unknown to the
CiscoSecure user database and the Unknown User Policy dictates that an ODBC
database is the next external user database to try.
In either case, Cisco Secure ACS forwards the username and password to the
ODBC database via an ODBC connection. The ODBC database either passes or
fails the authentication request from Cisco Secure ACS. The relational database
must have a stored procedure that queries the appropriate tables and returns values
to Cisco Secure ACS. If the returned values indicate that the username and
password provided are valid, Cisco Secure ACS instructs the requesting AAA
client to grant the user access; otherwise, Cisco Secure ACS denies the user
access (
Figure 11-2
). Upon receiving the response from the ODBC database,
Cisco Secure ACS instructs the requesting AAA client to grant or deny the user
access, depending upon the response from the ODBC database.
