×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

Problem with ACS 5.1 connect to LDAP

Answered Question
Jun 8th, 2012
User Badges:

Any help on this subject would be great


I use ACS 5.1, connect with LDAP.


Test bind to server succeded.

Result of testing this configuration is as follows:

Primary Server:

   Number of Subjects: 14

   Number of Groups: 19


but user login is failed.

In monitor show error "22056 Subject not found in the applicable identity store(s)."


capture for our LDAP configuration on attact file.


Regard

BW

Correct Answer by mauzamor about 5 years 2 months ago

Hi there,


LDAP as any other protocol has some limitations, and this is one of them. LDAP doesn't support PEAP Mschapv2, take a look to the compatibility chart below:



Here is one of the documents that metions this compatibility issue just in case you need it:


http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.1/user/Overvw.html#wp824718


Let me know if this answers your questions.


Rate if it helps!

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Loading.
jrabinow Fri, 06/08/2012 - 06:55
User Badges:
  • Cisco Employee,

Which authentication protocol are you using?

internet_pratama Fri, 06/08/2012 - 19:39
User Badges:

Thanks for your response,


authenticaiton that we use is PEAP - EAP-MS-CHAPv2.


Our Protocol Configuration on ACS 5.1


Our PC configuration



Thx

BW

Correct Answer
mauzamor Sat, 06/09/2012 - 06:40
User Badges:
  • Bronze, 100 points or more

Hi there,


LDAP as any other protocol has some limitations, and this is one of them. LDAP doesn't support PEAP Mschapv2, take a look to the compatibility chart below:



Here is one of the documents that metions this compatibility issue just in case you need it:


http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.1/user/Overvw.html#wp824718


Let me know if this answers your questions.


Rate if it helps!

internet_pratama Wed, 06/13/2012 - 03:52
User Badges:

Thanks for answers,


Because LDAP doesn't support PEAP Mschapv2, so what can we do if we have acs 5.1 server connect to LDAP and we have user windows 7?


Please give us suggest.


Thx

BW

Jatin Katyal Wed, 06/13/2012 - 03:58
User Badges:
  • Cisco Employee,

Peap Mschapv2 only works with Active Directory, if we can change  database from LDAP to windows AD then it will be supported. On the ACS  5, you need to select AD1 as a identiy store.


Regards,

Jatin



Do rate helpful posts-

mauzamor Wed, 06/13/2012 - 05:24
User Badges:
  • Bronze, 100 points or more

Hi there,


Basically you have 2 options:


1. Connect the ACS 5.x to Active Directory instead of LDAP (AD doesn't have the PEAP limitation.). This will be the easier option as the ACS 5.x - AD integration is pretty straigh forward, you only need the following:


-Domain name

-AD account with role "Account Operator"

-Configure ACS clock and time zone same as your AD servers


http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.1/user/guide/users_id_stores.html#wp1171071


or


2. Change the connection protocol from PEAP to EAP-TLS for example, however this will take a lot more time and work as you will need to create and assign unique certificates for each user. From the chart above you can confirm that EAP-TLS is supported by LDAP.


http://www.cisco.com/en/US/partner/docs/net_mgmt/cisco_secure_access_control_system/5.1/user/guide/common_scenarios.html#wp1052872


Let me know if you need more information.



Rate if it helps!

Actions

This Discussion