Knowledge Share – ACS authentication to multi AD Domains

Have another one for ya, the other day I faced a customer request to add another domain to their ACS’s external databases. No problem I thought to myself, just go in to the external databases menu option, select the Microsoft link and click add. Well, as it turned to be, ACS can only have one Microsoft AD domain configured; there was no ‘add’ button on the screen. What are my options? Let’s Google it, someone must have done it before, no luck. How about netpro (wish it was visible to Google)? Some clues here, user manuals, design guides – as it turned to be you can either install another ACS (one per domain) and configure it as a proxy in the main ACS, or go for LDAP. ACS can have multi LDAP external databases and it doesn’t require a remote agent when running the appliance version of ACS. What is a remote agent? ACS which runs on the appliance based platform can not communicate to a windows domain without a dedicated machine which runs windows and is a member/domain controller in the domain (aka, remote agent). LDAP does not require it. What’s the catch? Some things are not going to work in LDAP, try to place groupA within groupB and have ACS identify users from group A by specifying group B (nested group will not work). There are other things to loose, but if you can manage without them, it’s a money saver. The tricky part with LDAP is to identify the exact distinguished name (DN) of the objects and containers and other fields you need in there. A good tool to assist with that is an LDAP browser, the one I was using is available at: http://www.ldapadministrator.com/download.htm, Microsoft has one also, called ldp, and it is in the windows support tools. The default values you will see in the configuration screen are not going to work in AD, you need to have something like that for the integration to work: [img]https://sites.google.com/site/avnerizhar/Home/acs-ldap-window.jpg[/img] You will need a service account that will have a read only access to the entire AD hierarchy, didn’t need to make that one an administrator (although the manuals state it should be). You will need to find the DN of that user and configure it in the ACS (screen not shown here); the LDAP browser can assist with that. Once that part is done, you can go into the group mapping menu and map your domain groups into ACS groups, if you can’t see any groups from LDAP (AD), something is not configured correctly, probably your service account. Try to use those credentials in the LDAP browser and see if that works. When group mapping is completed, don’t forget the unknown user policy, that one is telling ACS where to look for users that can’t be located in its internal database (which will be true for any AD/LDAP user). That’s it; questions are welcome, later …