Yes, They can autheticate unless you don't have MAR enabled on the ACS 5.0
You may check this under Managing user and indentity store >> Microosft active directory >> MAR (This option shouldn't be checked).
Machine access restriction (MAR) >> ACS machine access restriction (MAR) features use AD to map machine authentication to user authentication and authorization, and sets a the maximal time allowed between machine authentication and an authentication of a user from the same machine. Most commonly, MAR fails authentication of users whose host machine does not successfully authenticate or if the time between machine and user authentication is greater than the specified aging time.
I would suggest you to upgrade ACS to atleast 5.1 because......
The below listed Features are Not Supported IN ACS 5.0
The following features are not supported in ACS 5.0:
•
Integration with RSA server or RADIUS Token One Time Password (OTP) servers.
•Integration with SQL DB via ODBC, for external authentication and identity information.
•The following Extensible Authentication Protocol (EAP) methods are not supported:
–LEAP
–EAP-FAST/GTC
–EAP-FAST/TLS
–PEAP/GTC
–PEAP/TLS
•Support for locally significant external resources (ID stores, and so on) in a distributed deployment.
•RADIUS and TACACS+ Proxy.
•Terminal server access control (port-based TACACS+ access control).
•Complete TACACS+ support for device administration (password change, and so on).
•RADIUS Virtual Private Network (VPN) and RADIUS-based device administration (for shell access to CLI for third-party network devices).
•ACS administrator and internal user password policies.
•Application access control for CiscoWorks applications.
•CSUtil features.
•Network access restriction to users whose Windows accounts have Windows dial-in permission.
•IP Pools Server feature.
•Support for defining the maximum number of simultaneous sessions for a user or user group.
Regards
Jatin
~Do rate helpful posts.
