Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are a sort of service provider network for schools, and use a Cisco ACS and its internal user database to authenticate users onto the remote access VPN which we provide. Every school we support has a separate Windows domain.

We would like to be able to use the ACS to connect to the different school ADs to be able to allow them to authenticate using their local network credentials.

Can this be done, and if so is there a specific software version of the Cisco ACS that is required? We are currently running 3.3 and I don't seem to be able to find a way of making this work.

Thanks, Tom

share|improve this question
I'm curious: Were you able to get this to do what you wanted? – Evan Anderson Jul 10 '09 at 13:50
Not yet no. I'd close this question if I knew how! – Tom Bell Oct 1 '09 at 14:33
up vote 2 down vote accepted

The install guide for ACS 3.3 (see briefly mentions trusted domains, as does the end-user documentation ( I suppose you could create one-way trust relationships with each of the schools Active Directory infrastructures to facilitate doing this via AD.

The negative thing about doing this with an AD trust relationship is that you're going to need name resolution for the schools' domain controller computers. You might be able to use the "Generic LDAP" user database functionality and get by with using IP addresses of their Active Directory domain controllers in lieu of using the underlying plumbing in Windows to handle doing the authentication against their AD databases.

Finally, it looks like an ACS 3.3 install can use another RADIUS server for token-based authentication. I'd try that with a standard RADIUS server (w/o actually using tokens) and see if you can get ACS to authenticate to another RADIUS server. If you can, you could ask the schools to run a RADIUS server (like Microsoft IAS) and expose only that to you. That would make both of you as de-coupled as possible while still accomplishing what you want. It's a long shot, but it might work.

I'd probably pursue the generic LDAP route first (

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.