Filter
Top Products
8-24
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 8 Managing Users and Identity Stores
Managing External Identity Stores
Failover
ACS 5.3 supports failover between a primary LDAP server and secondary LDAP server. In the context
of LDAP authentication with ACS, failover applies when an authentication request fails because ACS
could not connect to an LDAP server.
For example, as when the server is down or is otherwise unreachable by ACS. To use this feature, you
must define primary and secondary LDAP servers, and you must set failover settings.
If you set failover settings and if the first LDAP server that ACS attempts to contact cannot be reached,
ACS always attempts to contact the other LDAP server.
The first server ACS attempts to contact might not always be the primary LDAP server. Instead, the first
LDAP server that ACS attempts to contact depends on the previous LDAP authentications attempts and
on the value that you enter in the Failback Retry Delay box.
LDAP Connection Management
ACS 5.3 supports multiple concurrent LDAP connections. Connections are opened on demand at the
time of the first LDAP authentication. The maximum number of connections is configured for each
LDAP server. Opening connections in advance shortens the authentication time.
You can set the maximum number of connections to use for concurrent binding connections. The number
of opened connections can be different for each LDAP server (primary or secondary) and is determined
according to the maximum number of administration connections configured for each server.
ACS retains a list of open LDAP connections (including the bind information) for each LDAP server that
is configured in ACS. During the authentication process, the connection manager attempts to find an
open connection from the pool. If an open connection does not exist, a new one is opened.
If the LDAP server closed the connection, the connection manager reports an error during the first call
to search the directory, and tries to renew the connection.
After the authentication process is complete, the connection manager releases the connection to the
connection manager.
Authenticating a User Using a Bind Connection
ACS sends a bind request to authenticate the user against an LDAP server. The bind request contains the
user's DN and user password in clear text. A user is authenticated when the user's DN and password
matches the username and password in the LDAP directory.
• Authentication Errors—ACS logs authentication errors in the ACS log files.
• Initialization Errors—Use the LDAP server timeout settings to configure the number of seconds that
ACS waits for a response from an LDAP server before determining that the connection or
authentication on that server has failed.
Possible reasons for an LDAP server to return an initialization error are:
–
LDAP is not supported.
–
The server is down.
–
The server is out of memory.
–
The user has no privileges.
–
Incorrect administrator credentials are configured.
• Bind Errors