Authorization issue between ACS 5.2 and AD 2003

[bberry]

I am in the process of setting up an ACS evaluation that will authenticate against a Windows 2003 AD. I am currently testing this with AAA TACACS+ but will evenutally setup 802.1x authentication. My problem however seems to be between the ACS and AD.

I have the AD External Identity store configured and successfully tested for connectivity. I created a shell profile and a command set and also created an access ploicy for Device Admin. I added the AAA commands to my test switch and do get prompted for username and password.  This is where my issue starts. Regardless of what username and passwword I enter, I always fail authentication. At least that is what is in the reports and I have 0 hits on my Access and Authorization policy rule. I am using as basic as a config as I can get with simply using a contains from one of the groups I am in for the policy rule. I had a non-AD admin account to start with thinking maybe a rights issue with the AD account but have moved to an AD admin account with no change in the results. I saw a post somewhere that the time stamps on the AD server and the ACS had to almost be perfect and recommended that NTP for ACS be the AD server as that could cause issues and I have done that as well with no change. I am wondering if there is something specific I needed to configure or something I missed between the ACS and the AD? Is there a way I can display what is passed back and forth between the ACS, or the switch, and AD to verify content? I put a call into my local SE and he is as puzzled as I am. He is going to set this up in his lab and see if he can replicate but in the mean time I figured I would post something here and see if anyone else has ever crossed this issue. I do not have a whole lot of days left on my 90-day evaluation.

[bberry]

Update - Ok .. I may have figured out a reason why. By default there are specific authentication protocols (EAP-FAST and PEAP, PAP, MSCHAPv1, MSCHAPv2, EAP-GTC, EAP-TLS) that are supported with AD and I now have two more questions. First is the protocol something that I need to get my AD Admin to enable or are they enabled by default? I have AD AD Browser and it seems to work fine in regards to browsing our AD structure so figure it has to be something along these lines now that is keeping things from working.

Secondly, I figure there is one protocol that is better and more secure over the other or more likely one protocol supports different features over the other. Is there an industry standard?

I am still trying to figure out if this is the root issue but sem to be having a similar issue if I configure an LDAP server. I can specify the server and can connect but am unable to extract the groups list when completing the config. Once again I am using the same information in an LDAP browser without any issues.

Thoughts???

Brent