my guess is none of the switches and routers.
the cisco equipment talks to a RADIUS or TACACS+ authentication server, which in turn can talk to LDAP, AD or other auhtentication databases.
Cisco has Cisco ISE for this function.
appliances like the WLC-9800 series may have direct LDAP authentication.
