Windows Authentication With A Domain Specified - Cisco 2509 - Router - EN User Manual

Chapter 12 Administering External User Databases

Windows Authentication with a Domain Specified

Note
78-14696-01, Version 3.1
Cisco Secure ACS communicates with the Windows operating system of the
Cisco Secure ACS server to perform authentications. Windows uses its built-in
facilities to forward the authentication requests to the appropriate domain
controller. There are two possible scenarios to consider:
• Authentication requests in which the domain name is supplied
Authentication requests in which the domain name is omitted
•
When a domain name is supplied as part of a authentication request,
Cisco Secure ACS detects that a domain name was supplied and tries the
authentication credentials against the specified domain. The dial-up networking
clients provided with various Windows versions differ in the method by which
users can specify their domains. For more information, see
Networking Clients, page
If the domain controller rejects the authentication request, Cisco Secure ACS logs
the request as a failed attempt.
For Windows 95, Windows 98, Windows ME, and Windows XP Home, the dial-up
networking client provided with Windows only allows users to specify their
domains by submitting the usernames in a domain-qualified format, that is,
DOMAIN username. Using a domain-qualified username allows
\
Cisco Secure ACS to differentiate a user from multiple instances of the same
username in different domains. For unknown users who provide domain-qualified
usernames and who are authenticated by a Windows NT/2000 database,
Cisco Secure ACS creates their user accounts in the CiscoSecure user database in
the form DOMAIN username. The combination of username and domain makes
\
this user unique in the Cisco Secure ACS database.
Cisco Secure ACS does not support the user@domain form of qualified
usernames.
It is possible for unknown user processing to create more than one user account
for the same network user. For example, if a user provides a domain-qualified
username and successfully authenticates, Cisco Secure ACS creates an account in
the format DOMAIN username. If the same user successfully authenticates
\
without prefixing the domain name to the username, Cisco Secure ACS creates an
account in the format username. If you rely on groups rather than individual user
11-10.
User Guide for Cisco Secure ACS for Windows Server
Unknown User Processing
Windows Dial-up
12-5