Hello,
Instead of creating a separate rule for the credentials validation you can edit the existing one that points to AD1 (only) and change it to a result on the ACS that checks both AD1 and Internal Users. In that case we need to use Identity Store Sequence. Refer to the steps below:
On the ACS GUI > Users and Identity Stores > Identity Store Sequences > Create > Select "Password Based" and on the first box move AD1 and Internal Users to the right. Please do the same on the box at the bottom.
The option "Internal User/Host Advanced Option: If internal user/host not found or disabled then exit sequence and treat as "User Not Found" should stay unchecked. Click submit.
After creating the ID Store Sequence you need to change the Identity Result where you had AD1. Now the name of the ID Store will display as an available option. Please select that one and save the changes.
With the above configuration, the expected behavior would be:
1) ACS receives a request from the Internal User.
2) ACS tries to validate the credentials against AD.
3) AD returns an "User Unkown" response.
4) ACS moves to the Internal Users.
5 ACS successfully authenticates the user validating the provided credentials against Internal Users.
Hope this helps.
Regards.
