Lobby Ambassador Auth

thomas03usmcsf · ‎08-01-2011

We need to allow a certain AD group to authenticate to WCS as a lobby ambassador. I have an ACS 5.x, but there is very little documentation between WCS 7.0.116 and ACS 5.x. Any links or suggestions?

Sent from Cisco Technical Support iPhone App

Nicolas Darchis · ‎08-13-2011

I wrote this just for you ;-)

https://supportforums.cisco.com/docs/DOC-17909

George Stefanick · ‎08-14-2011

Nice work Nick! 5+

"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
___________________________________________________________

thomas03usmcsf · ‎08-14-2011

Hey Nick,

Thanks for the doc, I configured most of these settings last week, but I haven't had a chance to test yet because I am in the middle of a (500) 3502 deployment. I did see that you added the virtual domain in the shell, which I did not have. I should have time to test on Monday. Thanks again.

Sent from Cisco Technical Support iPhone App

Nicolas Darchis · ‎08-14-2011

it's mandatory, even if you don't use virtual domains, you have to put "root" then.

Cheers.

Nicolas

thomas03usmcsf · ‎08-15-2011

Hey Nicolas,

Getting closer, but I am receiving an error when logging into WCS. I ahve attached the error and the ACS config. Thanks again.

Nicolas Darchis · ‎08-22-2011

This looks impossible.

I've already seen such behaviors when the ACS says "runtime process not running" which is an issue which happens sometimes. When this happens, you can configure the ACS as you like but the authentication process keeps using the same config version and does not use all your changes. So a small reboot of the ACS to make sure you're not running into that problem can help.

Otherwise a sniffer trace on WCS/NCS to see if the attribute is really arriving there or not.

Nicolas