Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Downloadable ACL for users only?

Hello all,

in ACS 5.4 I need customized ACL for users only.

My scenario:

There is a way to use some "Downloadable ACLs" in authorization profile but I want to define specific ACLs for some exeptions. For example: User A and user B get autorization profile "X". But user B is not allowed to access on a host. This "Deny rule" I will configure with custom attributes in the internal user store.

Is that possible? How can I implement this rule?

best regards,

Stefan

1 ACCEPTED SOLUTION

Accepted Solutions

Downloadable ACL for users only?

Hi,

You can do this by following these steps:

1. Set a user defined dictionary attribute under System Administration > Dictionary > Identity >Internal Users name it what you want and make sure the value is string

2. Create the DACL in Named Permission Objects under the policy elements section

3. Under the user account you will now see a filed for the dictionary name you called in step 1, make sure the filed matches the dacl you created in step 2

4. Create your authorization profile under "common tasks" Set Dynamic as the DACL drop down select Internal Users and set the value to the attribute you created in step1.

5 map the authorization policy to the access policy using the conditions that will give you these results.

6. test and you should have what you are looking for.

Thanks,

Tarik Admani
*Please rate helpful posts*

Tarik Admani *Please rate helpful posts*
1 REPLY

Downloadable ACL for users only?

Hi,

You can do this by following these steps:

1. Set a user defined dictionary attribute under System Administration > Dictionary > Identity >Internal Users name it what you want and make sure the value is string

2. Create the DACL in Named Permission Objects under the policy elements section

3. Under the user account you will now see a filed for the dictionary name you called in step 1, make sure the filed matches the dacl you created in step 2

4. Create your authorization profile under "common tasks" Set Dynamic as the DACL drop down select Internal Users and set the value to the attribute you created in step1.

5 map the authorization policy to the access policy using the conditions that will give you these results.

6. test and you should have what you are looking for.

Thanks,

Tarik Admani
*Please rate helpful posts*

Tarik Admani *Please rate helpful posts*
213
Views
0
Helpful
1
Replies