Trusted User Authentication

Question

Hi,
Our solution currently offers three SSID's.  One corporate SSID for trusted users (employees) with trusted (company managed) devices, one guest SSID for external guests who are not trusted and use non-trusted devices and then a third "guest" SSID that allows trusted users (employees) to connect using untrusted (personal) devices to access the Internet via a separate proxy system.  The guest SSID for trusted users is the focus of this question.
We currently use a local RADIUS database on ACS 5.2 for the users, which works but requires another user account and obvious password management overhead.  Given that a global employee directory exists which has its own account & password management system in place has made me consider this as an alternative to local authentication on ACS.
The external identity store is an LDAP database and I have configured network access for the ACS to query the schema.
I understand that web authentication can use LDAP as an authentication mechanism, however I would like to keep the SSID as secured using 802.1x if possible and not use an open or PSK secured solution as this would contravene current security standards.
So, can I configure the WLC to send an authentication request to the ACS via RADIUS over 802.1x and then for the ACS to forward that request on to an external identity store using LDAPS?
I am currently reveiwing the configuration document and believe I have each individual component in ACS configured but cannot see the LDAPS traffic ever leaving it to query the external identity store.
Any thoughts or comments would be appreciated....
Thanks,
Dave

Answer 1

Hi Dave,
That is surely possible and that is what LDAP identity store is fore.
You create the LDAP identity store and point the WLCs to use the ACS (not the LDAP server).
Now, when a wifi client tries to connect the WLC sends the request to the ACS.
At this point the request reached ACS. So, in order to proceed with quering the LDAP server for that user, you need to tell the ACS for this user that is connecting to this SSID please send the query to the LDAP server and trust what it tells you about the user authentication status.
Have you configured this piece of configuraiotn on ACS? to send the traffic to the LDAP DB?
In the Access policy you need to choose the configured LDAP identity store. Have you done that?
If you still have problems please try to provide screenshots of you config.
Regards,
Amjad
Rating useful replies is more useful than saying "Thank you"