Combining multiple AD security groups in ACS 4.2

Answered Question
Jun 5th, 2009


Our ACS is used for AAA for wireless, IOS CLI access and unix server access. For both net admins and unix admins, there are two levels, so effectively we have 5 individual device groups which a user may be permitted to access.

User groups are defined in Active Directory.

I am looking for a way to combine information from multiple AD security groups to determine what a user can access. For instance, a net admin may or may not be a unix admin as well.

Is there a way of doing this other than having to have a large number of AD groups with one for each combination of authorization privilidges?



I have this problem too.
0 votes
Correct Answer by Jagdeep Gambhir about 7 years 7 months ago

HI Luke,

Setting hybrid mapping is the best way to achieve it.



Do rate helpful posts

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Jagdeep Gambhir Fri, 06/05/2009 - 06:49

You need to set up group mapping. This is how it works.

Lets say that you have three different groups on AD for NetworkAdmin, RouterAdmin, Wireless.

Go to external user database ==Database Group Mappings==Windows NT/2000==select the domain to which you are authenticating==Add mapping.

Select the AD group NetworkAdmin and map it to ciscosecure group 1 select the AD group RouterAdmin and map it to ciscosecure group 2 select the AD group Wireless and map it to ciscosecure group 3

Group mappings work in the order in which they are defined, first configured mapping is looked upon first then second, third and so on. If a user is in AD group NetworkAdmin and that is mapped to ACS group 1 and it is first configured mapping it will be looked for FIRST (If a user exists in NetworkAdmin group it will always be mapped to ciscosecure group 1 and NO further Mappings for this user is checked and user is authenticated or rejected)

Scenario: if you have a user called cisco, in NetworkAdmin group, cisco1 in RouterAdmin group, and cisco2 in Wireless. They will always be dynamically mapped to ACS group 1, 2 and 3 respectively as per above mappings.

You can check the mappings on the passed authentications for users as to what group are they getting mapped to.


Now if you want a NetworkAdmin user to authenticate to NetworkAdmin devices and not wireless or RouterAdmin devices you would need to apply NARs to group 1 because NetworkAdmin users are connecting to that group. Which you will permit Access on group basis to a particular NetworkAdmin NDG or individual NetworkAdmin NAS device.


If you are applying NARs for Wireless or VPN devices.. you would need to configure both IP based AND CLI/DNIS based together because NARs were originally designed for cisco IOS for routers and switches.

IMPORTANT: If a user successfully authenticates to AD database once, its username is cached on the ACS database (NOT password) the only way to remove the previously cached username is to go to usersetup find that user and delete it manually.

ACS will not support the following configuration:

*An active directory user that is a member of 3 AD groups (group A, B and C) *Those 3 groups are mapped within ACS as follows Group1->A,Group2->B and Group3->C.

*The user is in all 3 groups however he will always be authenticated by group 1 because that is the first group he appears in, even if there is a NAR configured assigning specific AAA clients to the group.

However there if your mappings are in below order...

NT Groups ACS groups

A,B,C =============> Group 1

A =============> Group 2

B =============> Group 3

C =============> Group 4.

You can create a DIFFERENT rule for the users in A,B,C by configuring the NARs in group1.

This rule WILL apply for the use ONLY if he is present in ALL three groups (A,B and C).

You can create a rule for users in group A (Group 2) You can create a rule for users in group B (Group 3) You can create a rule for users in group C (Group 4)



Do rate helpful posts

lmather Fri, 06/05/2009 - 06:53


Thank you for the detailed reply. If I understand correctly, I cannot do anything clever with NAP etc, instead the only way to have some netadmins that can access unix and some that can't is to create a hybrid group in AD/ACS which has users allowed to both?

Many thanks,


Correct Answer
Jagdeep Gambhir Fri, 06/05/2009 - 07:36

HI Luke,

Setting hybrid mapping is the best way to achieve it.



Do rate helpful posts


This Discussion