topic Re: map acs to ad in Network Access Control

map acs to ad

Network Pro — Mon, 11 Mar 2019 01:54:00 GMT

Hi,

i have several different groups on the ACS (example: finance, sales, marketing). how do i map this to AD? (for example, if i have to put a person under sales group then i want to goto AD and add him to the member of sales and this should dynamically map and reflect on ACS)

Thanks

map acs to ad

Network Pro — Tue, 13 Mar 2012 15:06:17 GMT

any one can i get the ACS to dynamically map by the group on AD

map acs to ad

Ven Taylor — Tue, 13 Mar 2012 15:38:39 GMT

Yes. You can tell ACS to query AD via LDAP.

What version of ACS are you using?

Re: map acs to ad

Network Pro — Tue, 13 Mar 2012 16:37:05 GMT

4.1 acs

Sent from my Windows Phone

Re: map acs to ad

Ven Taylor — Tue, 13 Mar 2012 19:54:59 GMT

We're using 4.2, so it's probably very similar.

Log into your ACS, click the External User Databases button.

Click External user Database Configuration link

Click Windows Database

Click Configure.

Pretty straightforward from there, but I think we had to do something on the AD server too.

Here's a link to the Cisco page that will guide you.

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.1/user/UsrDb.html#wp353636

Ven

Re: map acs to ad

Network Pro — Wed, 14 Mar 2012 10:40:35 GMT

Thanks for this. I have already done this bit. What I want to do is, if add a member to sales group on AD then I want ACS to create a profile dynamically and map it to the sales group on ACS server. I know you will need to go into group mapping and select the domain and map it but cant remember exactly

Sent from my Windows Phone

Re: map acs to ad

Network Pro — Thu, 15 Mar 2012 13:12:33 GMT

any thoughts on this?

map acs to ad

minkumar — Mon, 19 Mar 2012 21:53:30 GMT

ACS cannot create the dynamic group automatically,

you will need to go external user database > database group mapping> windows database > select the domian and map the AD group to ACS

Re: map acs to ad

Network Pro — Tue, 20 Mar 2012 11:53:35 GMT

Thanks for this. I meant dynamic entry on ACS. Example if I have a user Bill and assign to sales group in AD then will ACS automaticaaly create a entry on ACS with the name Bill mapped to sales team (considering I have done what you have told me to)

Thanks

Sent from my Windows Phone

Re: map acs to ad

minkumar — Tue, 20 Mar 2012 12:55:01 GMT

yes, Your understanding is correct. If the AD group is mapped with ACS already. Then in that case, as soon as the authentication is done for the user. The dynamic entry will be created automatically.

In order to verify, whether the user has been created or not. You can do as follows:

user setup> list all users or you can click on the alphabet > you will be able to see that account

Let me know if you have any further questions.

Re: map acs to ad

Network Pro — Tue, 20 Mar 2012 14:44:35 GMT

Thanks for this. I have already mapped the user to the group and linked ACS and AD. But dynamic entry is not created. However on the ACS I can see there is /local, /xyz (domain name) , /default - 3 different domains. The /local has all users mapped to default group on ACS. The /xyz is in correct order - the way I wanted to map. I presume its not wokring as ACS goes in order. It first looks at /local and then goes to xyz. Is this correct? So if jli delete the /local it shd work ?

But just want to confirm one thing - i don't have to create an entry for the users if manually if goes well, isn't it?

Thanks

Sent from my Windows Phone

Re: map acs to ad

minkumar — Tue, 20 Mar 2012 15:13:01 GMT

Yup, It should work. we should be concerned about the AD domain. so if the/ local is deleted. It shouldnt make any difference.

if the group mapping is done then you dont have to create a seprate entry of the user.

Note: The entry will only be created, if the authentication is successfull.

Re: map acs to ad

Network Pro — Tue, 20 Mar 2012 16:46:35 GMT

Thanks will give this a shot and update you

Sent from my Windows Phone

map acs to ad

Ravi Singh — Thu, 12 Sep 2013 17:23:33 GMT

I would suggest you to watch the below video. and also request you to upgrade your version.

http://www.youtube.com/watch?v=zL1mRAcXN2I