Cannot authenticate with ACS because of USERNAME Length

Dear Experts,
I'm using Cisco ACS (Radius and TACACS+) to authenticate network devices in my network for administration, everything works great except one of the devices accepts usernames of 8 characters length only so when I change the authentication method of this device to use TACACS+ and I enter my username which exceeds 8 characters, only the first 8 goes to ACS and since it doesnt exist in the users database it will reject the authentication.
My username: 1234567890
when I authenticate using TACACS+, I can see 12345678 only...
Any suggestions please? for an example is it possible to add a rule if ACS sees username "12345678" it adds "90" then check the password and authenticate?
Thanks for the help in advance...
Amro

Network Configuration Prompts : http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-5/release/notes/acs_55_rn.html#61858
Prompt
Default
Conditions
Description
Username
admin
The name of the first administrative user. You can accept the default or enter a new username.
Must be from 3 to 8 characters and must be alphanumeric (A-Z, a-z, 0-9).
Enter the username.

Similar Messages

My 4th gen. shuffle keeps on sending me an error message that it cannot connect with iTunes because it's not formatted properly.

Hi,
About two days ago my shuffle started to send me an error message that it cannot connect with iTunes because it's not formated properly.
So I've already updated the softwer, I tried to use it with every single USB port on my computer and searched for solutions on the net but couldn't find any useful information...
I literally see the following message: The iPod "194" cannot be used with iTunes because it is not formatted properly.
Any ideas?....
Thank you!

If you cannot access the iPad because of the passcode, you have no choice but to restore it using the same steps that you would use if you forgot the passcode.
iOS: Forgotten passcode or device disabled after entering ...

SQL Server cannot authenticate using Kerberos because the Service Principal Name (SPN) is missing, misplaced, or duplicated

We are getting this below alert message, while using SCOM 2012 R2. Anybody have any idea how to resolve this on the SQL box ?
Thx...
SQL Server cannot authenticate using Kerberos because the Service Principal Name (SPN) is missing, misplaced, or duplicated.
Service Account: NT Service\MSSQL$SQLEXPRESS
Missing SPNs:
Misplaced SPNs: MSSQLSvc/mysqlbox.com:SQLEXPRESS - sqldbadmin
Duplicate SPNs:

To Fix this issue, You can check below links
http://support.microsoft.com/kb/2443457/EN-US
http://www.scomgod.com/?p=155
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer"Mai Ali | My blog:
Technical | Twitter:
Mai Ali

I have Mavericks installed. Cannot print with IPhoto because there are no themes

I cannot print with IPhoto because it says that I do not have themes. How do I install themes? JL

To re-install iPhoto
1. Put the iPhoto.app in the trash (Drag it from your Applications Folder to the trash)
2. Download it from the App Store to reinstall It's on your Purchases List* there.
For older versions that have been installed from Disk you'll need these additional steps:
2a: On 10.5: Go to HD/Library/Receipts and remove any pkg file there with iPhoto in the name.
2b: On 10.6: Those receipts may be found as follows: In the Finder use the Go menu and select Go To Folder. In the resulting window type
/var/db/receipts/
2c: on 10.7 or later they're at
/private/var/db/receipts
A Finder Window will open at that location and you can remove the iPhoto pkg files.
3. Re-install.
If you purchased an iLife Disk, then iPhoto is on it.
If iPhoto was installed on your Mac when you go it then it’s on the System Restore disks that came with your Mac. Insert the first one and opt to ‘Install Bundled Applications Only.
*Sometimes iPhoto is not visible on the Purchases List. it may be hidden. See this article for details on how to unhide it.
http://support.apple.com/kb/HT4928
One question often asked: Will I lose my Photos if I reinstall?
iPhoto the application and the iPhoto Library are two different parts of the iPhoto programme. So, reinstalling the app should not affect the Library. BUT you should always have a back up before doing this kind of work. Always.

Lenovo T400 cannot authenticate with WRE54G

I recently got a new Thinkpad (Lenovo T400) and am having trouble getting it to authenticate with my Range Expander (WRE54G). My Xbox360 and my wife's laptop have no trouble authenticating with Static WEP but I cannot. If I move towards my Router (WRT54GS) and select that access point it authenticates and picks up an IP address no problem. What's up? Thanks.

Which operating system you are using on the laptop ?
Which wireless card you are using on the laptop ?
If you are able to see the network name on your laptop but unable to connect then you can try updating the wireless adapter of your laptop as your other wireless devices are working fine.

WPA2 enterprise, Can not authenticate with ACS

Hi, I am setting up WPA2 enterprise for wireless users with PEAP authentication, but can not get authentication server to authenticate them, and failed reason is generic "EAP-TLS or PEAP authentication failed during SSL handshake"
The AP I am using is 1240AG running 12.3(8)JA, Radius server is ACS 4.0, I don't have any problem to get dot1x with PEAP authentication working for wired access, and I have almost identical client side configuration for wired and wireless user.
From ACS's point of view, it should not be aware of any difference between wired and wireless user, but ACS log shows otherwise:
1)AP is connected to a cat4k switch, I suppose AP should be the authenticator for wireless users, but ACS "failed attempts" log for attempted wireless user shows that the NAS IP is cat4k in stead of AP, why?
2)I am using the same laptop for both wireless/wired testing, ACS "failed attempts" log shows that for wired user, it correctly interpreted cached domain\login name, but for failed wireless user, the user-name field is totally different, yet debug on AP clearly shows that correct domain\login has been received by AP.
Debug output on AP is attached, hope experts here can quickly identify the problem.

Got it working by adding radius server configuration under GUI generated configuration:
aaa group server radius your-AAA-group-name
server your-radius-server#1-IPaddress auth-port 1645 acct-port 1646

Outlook anywhere can RPC from external but cannot authenticate with AD

HI all,
Recently, I have this weird problem surfacing and it has been bugging me ever since. Let me start of of our current setup: we have 2 CAS/HUB running on NLB and 2 MB on CCR. All 4 are installed with E2007 Sp2. We have users accessing their mailbox internally
and externally. We used self-signed certificate for all users so that they can use Outlook when they are not in the office. All was working fine for a few years when one day, one user bought a new notebook for us to configure. Following the procedure
like we had done numerous times, then, it prompt Outlook has to be online error
while using the external network. After checking all the Outlook over RPC settings and everything, all are configured as according to the plan and nothing has been changed. Internal network (ie using the company network ) all is ok.
Firewall has not been meddled with so I am not too sure it could be the problem. ( because other external users on their existing system are ok ).
Can anyone kindly advice?
Thanks
Eric

Does the new computer trust the self-signed certificate?
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

Forward authenticatie with ACS 3.3

Is it posible to forward a authentication request received from a client to an upstream RADIUS server ? The client sends credentials to ACS, and ACS must send it to another RADIUS server.
How can I do this ?

using Proxy Distribution option,
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/3.3/user/guide/n.html#wp342969
Regards,
Prem
Please rate helpful post, so that everyone can benefit for it.

Cannot authenticate with local client

I have ARD 3.7 installed on a 10.7.5 machine to manage the rest of the macs in my environment. For the life of me, I cannot get it to manage itself. I have run every kickstart command I can throw at it to allow privileges, reset reporting schedule, give it a new IP and DNS, but it still switches between Authenticating and Available rapidly until the agent crashes and, in turn, crashes the management console.
Has anyone else had this issue connecting to the local agent on the machine that the management application is installed?

I'm a bit confused as to what you are attempting. Do you mean that you are trying to use ARD to update or report on the system on which the ARD administrator is installed? If so, then to the best of my knowledge that just doesn't work. At least, it has never worked in any version of ARD I've tested.
If that's not what you meant, please post back and clarify.
Regards.

AAA authenticate to ACS Server

I am trying to get my cisco switches to authenticate to our ACS server through TACAS but I am running into a problem when I try to put in the secret key.
Below is an output
aaa new-model
aaa group server tacacs+ VTY
server 10.1.10.99
server-private 10.1.10.99 key BrAqaq4h
ip tacacs source-interface Vlan99
aaa authentication login VTY group VTY local
aaa authorization exec VTY group tacacs+ if-authenticated
aaa accounting commands 1 default start-stop group VTY
aaa accounting commands 15 default start-stop group VTY
aaa session-id common
Whenever I try to make the server-private key 7 BrAqaq4h I get the error
server-private 10.1.10.99 key 7 BrAqaq4h
%Invalid encrypted key: BrAqaq4h
I don't know if this is the reason I cannot authenticate with AD but on the server ACS that is the key it has under every other device that is working.
aaa new-model
aaa group server tacacs+ VTY
server 10.1.10.99
server-private 10.1.10.99 key 7 0529142E304D5F5D11
ip tacacs source-interface Vlan99
aaa authentication login VTY group VTY local
aaa authorization exec VTY group tacacs+ if-authenticated
aaa accounting commands 1 default start-stop group VTY
aaa accounting commands 15 default start-stop group VTY
aaa session-id common
The last output is a device where I can authenticate correctly. Does anyone have any ideas as to why this doesn't work? The vty settings on both devices are the same.
line vty 0 4
privilege level 15
logging synchronous
login authentication VTY
transport input all

Hi Jeff,
If you use the command, "server-private key 7 " command, then the string that is entered is considered to be encrypted text. If no number or 0 is entered, the string that is entered is considered to be plain text.
So if you are planning to enter your shared secret in plain text, try using the command "server-private key 0 " or "server-private key ".
If after entering the shared secret in plain text (using the 0 or no number) and if you are facing issue in authentication, then check the failed attempts logs in the tacacs+ server which should give you the hint of the issue.

IPod Cannot Communicate with iTunes

I have been using my ipod/itunes for a while now, but yesterday when I connected my ipod (5th gen Video) to my computer itunes gave me the following error message:
"The software required for communicating with the ipod is not installed correctly. Please reinstall iTunes to install the iPod's software"
Well, I did this it didnt work, same error. So I decided to delete all itunes/ipod software from my computer and reinstalled itunes from my initial cd. Plugged in my ipod, same error. I have gone through the 5 R's those didnt work. My iTunes opens and my library is there but I cannot sync with iPod because they cannot communicate so I cannot add any new music to my ipod. Any suggestions?

okay.
sometimes in earlier versions of itunes (itunes 6.0.x), that message could be caused by a snarlup in the registry keys on the PC. (plausibly in this case something like that might be related to the problem with the administrator account.)
in the 6.0.x days we could get some relief from that sometimes by applying the markinmadison technique:
markinmadison: Re: "The software required for communicating with the iPod is not installed..."
(in your case, rather than reinstalling itunes and the ipod updater, you'd just be reinstalling itunes. the ipod updater is no longer a standalone application ... itunes 7.0.x itself is used for updates and installs.)

Cannot Continue with migration...

while enanbling the Advanced GL Account determination, l encountered the following error message ' Cannot continue with migration because SAP business one integration EverSender on named server connected to the company database, close this program and reopeat migration'. il have closed the program several times but the message still comes each time i want to enable it. can anyone help me.

Hi,
Please check this thread:
Error while Enabling Advance GL Account option
Thanks.

ACS cannot Authenticate Aironet Users against Exernal DB (LDAP)

ACS cannot Authenticate Aironet Users against Exernal DB (LDAP)
Can anyone point me to a technical explanation of why this is true?
All I have found so far is one small note in a help file and something that might be related under EAP-FAST explanation.
I have posed this question to our Cisco account team but no response yet.
Just need to have a good explanation when explaining to mgmt why we need to have a special setup for WLAN users.

Hmmm....you should be getting more than that from debug radius and debug aaa authen if your AP is truly attempting EAP authentication. The debugs I generally use for this are 'debug aaa authen', 'debug radius', and 'debug dot11 aaa dot1x all' coupled with gathering the detailed support logs from ACS. A warning about 'debug dot11 aaa dot1x all'....it is VERY verbose and cryptic if you don't have alot of experience looking at it so it may be best to open up a TAC case. With these debugs turned on, you should see an EAPOL logon show up from the client (usually says 'received EAPOL packet...') and then a request for identity from the switch and a response from the client with a username and password. Then a series of RADIUS challenge/response packets will be passed which consists of the server cert being passed to the client for validation and then the client sending the username and password to the server. Then you will finally get an access-reject or access-accept packet from the RADIUS server. The failed and passed attempts logs in ACS can also provide good info as to what the source of the failure may be. Do you get any passed or failed attempts for these authentications?

Hi. I am using a time capsule for few PC s. I have made 5 different account to access time capsule. but in windows when i enter account name and password for one account, i cannot access other accounts, because windows saves username

Hi. I am using a time capsule for few PC s. I have made 5 different account to access time capsule. but in windows when I enter account name and password for one account, i cannot access other accounts, because windows saves username. how can i prevent this from happenning. I really need to access all my accounts and dont want it to save automaticlly.

Why have 5 accounts if you need to access all of them.. just have one account?
Sorry I cannot follow why you would even use the PC to control the Time Capsule. Apple have not kept the Windows version of the utility up to date.. so they keep making it harder and harder to run windows with apple routers.

I cannot go into iCloud because it always ask me for the password of my first identifiant and I do not have it and I am stock right there although I have registered with another identifiant and password it always bring me back to the first identifiant

I cannot get into iCloud because although I have registered a new ID
it always bring me back to the first identifiant
and I do not remember the password
so I am stock right there
even if I have a new identifiant
it ask me the password of the first identifiant
it is insane
thanks
Lucien
<Emails Edited by Host>

It's a bad iddea to post your email addresses - it's an invitation to spam - and I've asked the Hosts to remove them.
Go to http://appleid.apple.com , click on 'Reset Password', sign in with your 'gitanie' ID and proceed from there.

Cannot authenticate with ACS because of USERNAME Length

Similar Messages

Maybe you are looking for