ACS Integration with Microsoft Active Directory Services

Question

Hello Everyone,
I've been tasked to design the integration of ACS with MS AD. What I want to know is the below assuming I have a software ACS or a ACS device and the protocol for authentication is Radius
- What is the criteria for the AD to integrate with ACS software of appliance
- Should that AD be hosted on the domain controller or not?
- If not, on what (Domain Controller, Tree, Forest, Branch, Flower, Fruit  ) should the AD be hosted on?
- What will I have to do to authenticate users logging into Cisco Security Manager with ACS integrated with AD?
- Are there any other dependencies that I will have to categorically mention in my design document?
Thanks,
Rishi

Answer 1

In ACS v5.x, there is a screen for integrating the ACS with AD. 
     (Users and Identity Stores > External Identity Stores > Active Directory)
Just enter the local domain name (domain.com) and a valid AD administrator account username and password, and the ACS will connect to the domain.  This allows you to use existing AD credentials to login and administer your network devices. 
Tying the ACS to AD really only takes one screen and less than a minute, but you will still have to tell the ACS which AD groups get which permissions (for example, read-only or read-write access), and you will have to setup a search sequence (Users and Identity Stores > Identity Store Sequences) to tell ACS to first look at AD for credentials, then check the local ACS user database for valid accounts.  The permissions part is still fairly quick, and it only takes me about 45 minutes to build an ACS from scratch including all AD integration and custom RADIUS attributes for some of our devices. 
The authentication would occur like this:
User SSH/telnet/console to device
Device contacts ACS using TACACS or RADIUS
User receives login prompt and enters AD credentials
Devices sends credentials to ACS
ACS validates credentials in AD
ACS sends authentication OK message to Device
Device logs user in.
Command Authorization looks something like this:
User enters a command
Device sends command authorization request to ACS
ACS looks at which AD group the user belongs to and looks up permissions configured in ACS for that group
Based on the permissions you have assigned, ACS either sends an allow or deny message to the Device
Device allows or denies the user command.
Criteria:  We use an ACS 5.2 virtual machine and have had it work perfectly with Server 2003 and Server 2008.
AD is hosted on our local domain controller (Bonus:  no planting of flowers required!)
Dependencies: 
Issue:  The Device looks to ACS.  ACS looks to AD.  If AD fails, users cannot use their AD credentials to login.
          Device ---> ACS ---> AD
Solution:  Configure the Device to look at ACS first, then a local table if ACS is not available.  Also, configure the ACS to look at AD first, then a local ACS account list if AD is not available.  (You can configure local user accounts on the Device and in the ACS) 
          Device ---> ACS ---> AD
          Device ---> ACS ---> AD ---> ACS local
          Device ---> ACS ---> AD ---> ACS local ---> Device local
The new version of Cisco ACS is UNIX-based, and you can download a free trial to load up and try before you buy.  It is far FAR superior to the old ACS v3.3 that we had for years.
I hope this helps for your design document!
--Chris