Filter
Top Products
3-13
Configuration Guide for Cisco Secure ACS 4.2
OL-14390-02
Chapter 3 Configuring New Features in ACS 4.2
RSA Support on the ACS SE
Step 8 If you want to limit authentications processed by this LDAP configuration to usernames with a specific
domain qualification:
Note For information about domain filtering, see “Domain Filtering” in chapter 12 of the User Guide
for Cisco Secure ACS, 4.2.
a. Under Domain Filtering, click the Only process usernames that are domain qualified radio
button.
b. From the Qualified by list, choose the applicable type of domain qualification: Suffix or Prefix. Only
one type of domain qualification is supported per LDAP configuration.
For example, if you want this LDAP configuration to authenticate usernames that begin with a
specific domain name, select Prefix. If you want this LDAP configuration to authenticate usernames
that end with a specific domain name, select Suffix.
c. In the Domain Qualifier box, type the name of the domain for which you this LDAP configuration
should authenticate usernames. Include the delimiting character that separates the user ID from the
domain name. Ensure that the delimiting character appears in the applicable position: at the end of
the domain name if Prefix is selected on the Qualified by list; at the beginning of the domain name
if Suffix is selected on the Qualified by list.
Only one domain name is supported per LDAP configuration. You can type up to 512 characters.
d. If you want ACS to remove the domain qualifier before submitting it to the LDAP database, check
the Strip domain before submitting username to LDAP server check box.
e. If you want ACS to pass the username to the LDAP database without removing the domain qualifier,
uncheck the Strip domain before submitting username to LDAP server check box.
Step 9 If you want to enable ACS to strip domain qualifiers from usernames before submitting them to an LDAP
server:
Note For information about domain filtering, see “Domain Filtering” in chapter 12 of the User Guide
for Cisco Secure ACS, 4.2.
a. Under Domain Filtering, click the Process all usernames after stripping domain name and
delimiter radio button.
b. If you want ACS to strip prefixed domain qualifiers, check the Strip starting characters through
the last X character check box, and then type the domain-qualifier delimiting character in the X
box.
Note The X box cannot contain the following special characters: the pound sign (#), the question
mark (?), the quote (“), the asterisk (*), the right angle bracket (>), and the left angle bracket
(<). ACS does not allow these characters in usernames. If the X box contains any of these
characters, stripping fails.
c. If you want ACS to strip suffixed domain qualifiers, check the Strip ending characters from the
first X character check box, and then type the domain-qualifier delimiting character in the X box.