ACS 5.1. Using an identity store for authentication and another for authorization.

[altorres75]

Hello, I'm installing an ACS 5.1 and I'm trying to authenticate users for network access using one identity store and authorize the same user using another identity store (AD).  What I'm seeing is that the access-request after authentication is OK, but for authorization the ACS is trying to use the same initial identity store instead of quering the second one.

Can this be done, if so does anybody has a procedure for doing this?

Thanks in advance,

Regards,

Alex

[rottenberg]

Hi,

In general the answer to your question is yes, but there could be some problems. You should use identity sequence (what I guess you are already using), where you can specify, which identity store you use and optionaly specify a list of databases from which to retrieve additional authorization attributes. You can use this identity sequence in your policy. According to the documentation I would say that user is firstly authenticated and during this process also authorization parameters are acquired and then additional authorization databases is queried for additional authorization parameters. But what will happen in case when you acquire the same authorization parametr in authetication and authorization phase? Which parametr will get precedence? My guess is that authorization parametr retrieved during authentication will win.

ZR