topic ACS5: rules - continue on FAIL in Network Access Control

ACS5: rules - continue on FAIL

mlopacinski — Mon, 11 Mar 2019 01:43:29 GMT

Hello

Is it possible to create on ACS5 rule which will:

1. Try to authenticate user in external database1 (radius)

2. When external database1 returns FAIL (because of bad password) ACS5 should try to authenticate user in another external database2 (radius)

Is it possible to have such scenario ?

Thanx

ACS5: rules - continue on FAIL

camejia — Mon, 16 Jan 2012 22:40:52 GMT

Hello,

The only database that will allow that behavior when configured first on an Identity Store Sequence would be RSA when configured to use Native SDI. It has a setting that reads as follows:

"This Identity Store does not differentiate between 'authentication failed' and 'user not found' when an authentication attempt is rejected. From the options below, select how such an authentication reject from the Identity Store should be interpreted by ACS for Identity Policy processing and reporting .

Treat Rejects as 'authentication failed'

Treat Rejects as 'user not found'"

You can select either of the above two options in order to determine how will the ACS interpret the failure returned from the RSA.

For LDAP, AD or any other external database, if the ACS does the query to the external database, finds the username but the failure is caused due to a "Bad Password" the ACS will exit the Identity Store Sequence and will deny access to the user.

The only way for the ACS to keep querying databases in an ID Store Sequence is that the user account is not found on the current database.

Hope this helps.

Regards.

ACS5: rules - continue on FAIL

mlopacinski — Tue, 17 Jan 2012 08:02:18 GMT

Thanx for detailed description for Treat Rejects as 'authentication failed'

I have one more question for Treat Rejects as 'user not found'"

So - if my first external database: LDAP or AD return Treat Rejects as 'user not found'"

next external database can be queried ? (or this functionality is also only for RSA SDI) ?

Thanx

ACS5: rules - continue on FAIL

camejia — Tue, 17 Jan 2012 15:11:23 GMT

Hello,

Unfortunately the Treat Rejects as 'authentication failed' and Treat Rejects as 'user not found' options only apply when configuring RSA (Native SDI). Those would not apply for any other External Database like AD or LDAP.

Hope this clarifies it.

Regards.

ACS5: rules - continue on FAIL

mlopacinski — Wed, 18 Jan 2012 07:08:17 GMT

so - there is no way i could do a migration from one external database to another external database ?

(creating gradually new users in new database and deleting them from old database) ?

Thanx

ACS5: rules - continue on FAIL

camejia — Wed, 18 Jan 2012 17:37:02 GMT

Hello,

You will have to delete the user from the Old Database as soon as you create it on the New Database for the ACS to receive an "Unknown User" error and move to the next available database.

The problem is that if the ACS finds the user on the Old Database it will not move to the New Database and the failure would be reported as "Bad Password" as you stated on the beginning.

Regards.