Using ACS with Ironport?

Question

Hello
In our libraries we use a product called Netloan which authenticates the users using an SQL database. Effectively the users login to the machines with a Username and Pin number and this is authenticated via an SQL database and a session is opened for an hour, allowing the user access of the PC.
Once authenticated, the user the attempts to access the internet and the traffic is routed through to our Cisco Ironport appliance which provides the Web Filtering. We have no issues with the desktop devices as they are on an Active Directory domain so the Ironport sees thier traffic as authenticates and can provide different levels of filtering.
The Issue we have is with our Public Wifi users who connect up to an Access Point and authenticate with Netloan using a login page we have created on the wireless controller. Once authenticated however, the ironport does not see them as authenticated because they are using thier own devices....i.e not on the domain so we can only apply a default filtering policy based upon source IP address.
We need the ironport to provide different levels of filtering for the Public Wifi users, the same as it does for the Desktop ones, even though the Wifi users are using thier own devices..not on an AD domain.
Hopefully this makes some sort of sense!
Cheers

Answer 1

Just re-reading the PIX/ASA 7.2 command reference guide below:
http://www.cisco.com/en/US/docs/security/asa/asa72/command/reference/crt_72.pdf
It appears some of the above are known issues.
PASSCODE issue, page 2-17 states:
We recommend that you use the same username and password in the local database as the
AAA server because the security appliance prompt does not give any indication which method is being used.
Failure to LOCAL, page 2-42 states:
You can have up to 15 server groups in single mode or 4 server groups per context in multiple mode. Each group can have up to 16 servers in single mode or 4 servers in multiple mode. When a user logs in, the servers are accessed one at a time starting with the first server you specify in the configuration, until a server responds.
AAA Accounting, page 2-2 states:
To send accounting messages to the TACACS+ accounting server when you enter any command other than show commands at the CLI, use the aaa accounting command command in global configuration mode.
ASDM issue, page 2-17 states:
HTTP management authentication does not support the SDI protocol for AAA server group
So looks like all my issues are known "features" of PIX/ASA integration with ACS, any ideas of how to achieve a "slicker" integration?
Is there a roadmap to improve this with later versions of the OS?
Will the PIX/ASA code ever properly support the same features as IOS?
Would it be better to look at using something like CSM instead of ASDM?