04-12-2012 05:45 AM - edited 03-10-2019 07:00 PM
Hello
We are currently using Cisco ACS 5.3.0.40.2. One of the Services Selection Policy it hosts is:
The above setup works fine in most instances. We start to have problems when an external proxy server strips the domain suffix off the username in the Access-Accept packet e.g.
Is there any way to get ACS 5.3 to log proxied authentication requests? If not, can I configure ACS 5.3 to use the username in the Access-Request packet (rather than the username in the Access-Accept packet) for accounting?
Thanks
Andy
ps i don't have any control over the external proxy servers
07-09-2012 03:53 AM
ACS 5.4 will log proxied authentication requests. So in the above scenario with ACS 5.4, the proxied user someuser@somewhere.com will appear in the RADIUS authentication logs - it will still appear in the accounting logs as 'someuser' but you can you can easily match the accounting and authentication records.
Currently with ACS 5.3, i use a FreeRADIUS box to rewrite the usernames of proxied requests in case they are modified in the reply:
update proxy-reply {
User-Name := "%{proxy-request:User-Name}"
I'll be able to do this with ACS if I could manipulate Inbound RADIUS attributes - ACS 5.4 can manipulate Outbound RADIUS attributes only - Inbound manipulation will hopefully be introduced in a later version.
cheers
andy
04-16-2013 10:32 PM
Thanks Andy for coming back to comment on your own issue after about one year from the original post.
I hope others with same issue will find your comments useful.
+5 and keep up the good work.
Regards,
Amjad
Rating useful replies is more useful than saying "Thank you"
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: