Hi all,
Have recently installed the ACS Solution Engine. Customer needed to use AD as an external d/b for aaa authentication for engineers accessing their cisco boxes.
I have setup according to the documentation from cisco. Installed a remote agent to authenticate on behalf of the acs-se.
All is well. There are 2 child domains. The remote agent is a member server of the 1st child domain, so authenticating users belonging to the first child domain is not a problem. However, when users of the 2nd child domain tried to access the cisco boxes, the remote agent (belonging to the 1st child domain) failed to access the DC's AD of the 2nd child domain. Checked the acs log files and it says "External DB account restriction".
The remote agent has it's services run by a username that belongs to the 1st child domain, ie. CSACS. This user already has been granted read access to all the user folders in the AD of the 2nd child domain. Heck, by default, all users have read access even between child domains. There's no policy restriction applied for cross-domain access.
What could possibly be the problem? Any help, greatly appreciate it.
