ACS5.5 + WLC User-certificate and AD Integration Domain Stripping is it available?

Andrew Grech — Tue, 26 Mar 2019 00:34:05 GMT

Hi,

I am in the process of writing a change document for ACS5.5 so I can authenticate wireless users with a user client authentication certificate and check for active directory for group memberships. Currently the Common name for client authentication certificates is as follows.

DomainName\UserName example AcmeCorporation\Joe.Blogs

Does this common name need to be stripped or manipulated for the active directory lookup to succeed?

Many Thanks

Andrew

I found the following for ACS

Andrew Grech — Tue, 05 Jan 2016 02:09:33 GMT

I found the following for ACS 5.8

Hopefully it is the same in 5.5

http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-8/ACS-ADIntegration/guide/Active_Directory_Integration_in_ACS_5-8.html

Supported Username Formats

The following are the supported username types:

■SAM, for example: jdoe

■NetBIOS prefixed SAM, for example: ACME\jdoe

■UPN, for example: jdoe@acme.com

■Alt UPN, for example: john.doe@acme.co.uk

■Subtree, for example: johndoe@finance.acme.com

■SAM machine, for example: laptop$

■NetBIOS prefixed machine, for example: ACME\laptop$

■FQDN DNS machine, for example: host/laptop.acme.com

■Hostname only machine, for example: host/laptop

Should be good to go

I'll be using NetBIOS prefixed SAM, for example: ACME\jdoe

topic I found the following for ACS in Network Access Control

ACS5.5 + WLC User-certificate and AD Integration Domain Stripping is it available?

I found the following for ACS