Download Cisco Systems CSACS3415K9 User's Manual

Chapter 8
Managing Users and Identity Stores
Configuring Identity Store Sequences
Table 8-24
Certificate Authentication Profile Properties Page (continued)
Option
Description
Principal Username X509
Attribute
Available set of principal username attributes for x509 authentication. The selection includes:
•
Common Name
•
Subject Alternative Name
•
Subject Serial Number
•
Subject
•
Subject Alternative Name - Other Name
•
Subject Alternative Name - EMail
•
Subject Alternative Name - DNS
Perform Binary Certificate Check this check box if you want to validate certificate information for authentication against a
selected LDAP or AD identity store.
Comparison with
Certificate retrieved from
If you select this option, you must enter the name of the LDAP or AD identity store, or click
LDAP or Active Directory
Select to select the LDAP or AD identity store from the available list.
Step 4
Click Submit.
The Certificate Authentication Profile page reappears.
Related Topics
•
Viewing Identity Policies, page 10-22
•
Configuring Identity Store Sequences, page 8-77
•
Creating External LDAP Identity Stores, page 8-26
Configuring Identity Store Sequences
An access service identity policy determines the identity sources that ACS uses for authentication and
attribute retrieval. An identity source consists of a single identity store or multiple identity methods.
When you use multiple identity methods, you must first define them in an identity store sequence, and
then specify the identity store sequence in the identity policy.
An identity store sequence defines the sequence that is used for authentication and attribute retrieval and
an optional additional sequence to retrieve additional attributes.
Authentication Sequence
An identity store sequence can contain a definition for certificate-based authentication or
password-based authentication or both.
•
If you select to perform authentication based on a certificate, you specify a single Certificate
Authentication Profile, which you have already defined in ACS.
•
If you select to perform authentication based on a password, you can define a list of databases to be
accessed in sequence.
When authentication succeeds, any defined attributes within the database are retrieved. You must have
defined the databases in ACS.
User Guide for Cisco Secure Access Control System 5.4
OL-26225-01
8-77