ACS5: different external authentication method for each user account

[Roman Rodichev]

in ACS4 I could specify a different external authentication method for each user account. I'm trying to figure out how to do the same in ACS 5? When I go under Identity in Access Services, I see System:Username condition that I can use to identify the user that's logging in, so that I can direct him to a different identity source, but configuring separate policy for each user is very inconvinient and would require hundreds of policies in our case.

I was hoping we can create some kind of attribute for each user. SysAdmin > Configuration > Dictionaries > Identity > Internal Users. I created new attribute called "Identity Store" with Enumeration type, that has 4 values: Internal, Entrust Token, RSA Token, AD  account, and checked the box "Add Policy Condition". I can then go under each user and select the identity store for each user. But now I can't find where I can use it under Identity portion of an access policy. I can use it under "Group Mapping" but that maps it to a group, and not to an identity store. I need to use it somehow under Identity, but I can't find how.

[Bastien Migette · Accepted solution]

Hello Roman,

The attribute you have created will be available when the user is authenticated through internel ID Store, so you can't use it to select the ID store.

The best way to do that would be use other attributes that you have to differentiate the idendity store.
You can as well create an identity store sequence so that for each user, ACS will try to authenticate using several identity store.

You can, for example, use these:

Network Condition

>End Station filter

>Device filter

>Devide Ports filter

Here you can import the filters from a file, so it would be more scalable.

Hope this help.

[Roman Rodichev]

That makes sense, thank you