Windows domain account to view reports / manage ACS server.

[CCIEBret13]

All,

We have a Cisco ACS 5.2 deployment (appliance).  It has an existing integration with Active Directory.  We utilize this with RADIUS to authenticate our wireless users and TACACS for managing our network equipment.

The RADIUS reports are useful for other teams (outside my own) to be able to troubleshoot password and account lockouts (everyone forgets to change the password on their phone).

I would like to allow this team and other access to view the RADIUS authentications report.

I want them to be able to use their domain account to do this.  <<<-------  This is mandatory, based on our security policies.

We have tried using a local account and that works fine.

My system admin is telling me that domain accounts can't access the administrative pieces of ACS.

Is this true?

We have support to allow us to upgrade to the latest version of ACS.

[jrabinow · Accepted solution]

In ACS 5.4 it is possible to authenticate and authorize administrators based on external stores including AD accounts

[CCIEBret13]

I'm assuming this is a recent feature add then and was not available in my version.  I will dig into the release notes of 5.4.

[CCIEBret13]

Thanks this did answer my question.  You were correct.  AAC looks like a winner.

System Administration Enhancements

The System Administration enhancement includes:

•Administrative Access Control

ACS 5.4 introduces a new service type called the Administrative Access Control (AAC) service. The AAC service processes the authentication and authorization of the ACS administrators. The AAC service also processes the configuration of roles and permissions for ACS management and different administration operations. Only AD and LDAP are supported as the external databases for AAC. The RSA database is not supported. For more information, see User Guide for Cisco Secure Access Control System 5.4.

The enhanced AAC web interface includes:

–Policy-based authentication and authorization.

ACS 5.4 includes authentication against an external database, feasible by password type on administrator accounts in the administrators internal ID store and the ability to map between external groups and admin roles.