I have searched for two months and found that others have had similar issues. I cannot work out with any confidence the required values for the following: User Directory Subtree, Group Directory Subtree, User Object Type, User Object Class, Group Object Type, Group Object Class, Group Attribute Name. I have succeeded in getting the switch access experiment running with IAS RADIUS but NOT with Cisco ACS. Can you help me?
The documentation assumes that you have set up a generic LDAP server. In setting up the LDAP server in my lab, I have included the parameters I set up for each category and a little further explanation for how to set them up. It's important to note that in user configuration for Active Directory and/or any other generic LDAP server, these options are available for selection and administrator defined. They would not appear in generic local user and group server administration.
User Directory Subtree: Users
Group Directory Subtree: Users/homedir
User Object Type: ou=user
User Object Class: users
Group Object Type: Groups
Group Object Class: group
Group Attribute Name: MyName
By ensuring you have the appropriate equipment set up in your lab, this should mirror exactly with what the ACS guide is depicting.
This was first published in February 2007