Authenticate against external windowsdb member server

[mike.iacovacci]

I would like to know if anyone has been able to get the ACS appliance version to authenticate users against a Windows Member Server not a DC (no AD).

[gfullage]

Sure, but it can take a little bit of configuring, especially if you want to authenticate users in other trusted domains that the member server is not actually a member of.

Read the following and it should give you a good insight into what's needed:

http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs33/install/inst02.htm#wp981718

Specifically steps 5, 6 and 7 should get you going. I've never had to do Step 2 personally.

[mike.iacovacci]

The steps seem to be for running Cisco ACS on a Windows Member Server. I have a Cisco ACS Engine, and want to check a member servers local user database (no AD domain) for user/group on ACS. I noticed that ACS supports "AD", but what about the regular local user db. I am trying to avoid creating a domain to manage the users.

[gfullage · Accepted solution]

My bad, sorry.

When using the appliance you need to use the Remote Agent for Windows, the appliance will then talk to this agent to authenticate users in its SAM or AD database. You need this since the Appliance is not part of any domain, so it needs to pass off the usernames/passwords to a Windows server that can authenticate users.

You can read about it here:

http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacsapp/raig/rawi.htm

Basically install it on the member server and you should be good to go, it will automatically use the local SAM database to check for usernames/passwords. This is actually easier to set up than if you were trying to authenticate to a domain, since there's really nothing for you to do other than install the agent.