Authentication certificate based on cisco ACS

[Lee NGUYEN]

Hi all friend, and experts

I have a ACS 5.8 system. When i login to ACS via Web browser ( 443), used users : acsadmin & password. Now my Boss he want me config authentication ACS via certificate based.

Plz help me and guilde me, and clearly for me. What is the certificate base ?

Thank you so much

Regards

[nspasov · Accepted solution]

Hi there, I don't believe ACS admin access can be based on client-certificate. I know this feature exists in ISE but in ACS I only see username/password options. 

Thank you for rating helpful posts!

[Lee NGUYEN]

Hello Neno,

Yes this feature exists in ACS, but same you too i only see login via password based, and RSA based.

Anyone here help me plz, how ACS login ACS via certificate based work?

Thank you neno, and thank you all.

[Rajat Gupta]

Hello Lee,

At this point (ACS 5.8p4), this is not supported with Administration login.

Regards,

Rj

[Lee NGUYEN]

Thank you friend,

[Jatin Katyal]

My 2 cents :)

With ACS 5.x ,you can select any one of the following identity stores:

Internal Administrator ID store

Active Directory ID store

LDAP ID store

RSA SecurID store

RADIUS Identity store

This functionality got added in ISE where you've to select the attribute in the certificate that contains the administrator user name in the Principal Name X.509 Attribute field. If the AD record for the user contains the user's certificate, and you want to compare the certificate that is received from the browser against the certificate in AD, check the Binary Certificate Comparison check box, and select the Active Directory instance name that was specified earlier. However, i personally never saw this working accurately. I'm unsure how important this feature is for your enterprise but since the feature already exist in ISE, I don't think this is going to be introduced in ACS now. If you still want to try your luck, pls reach out to your accounts team and see if they get any better feedback on the same.

Regards,

Jatin

~ Do rate helpful posts.

[Lee NGUYEN]

Thank you Jatin :)