09-17-2009 09:27 AM - edited 03-10-2019 04:41 PM
Hi,
I want to have my MS IAS RADIUS check on the connection profile that a SSL VPN user selected: Users can only authenticate for profiles that match their group membership. But a single user can be allowed to connect to more than one connection profile, so forcing a user into a profile (with the CLASS attribute in the RADIUS Access-accept) does not work.
user jdoe, member of RemoteUsers, can login on RemoteUsersProfile
user bigceo, member of RemoteUsers and of RemoteExecutives, can login on RemoteUsersProfile and on RemoteExecutiveProfile
user bofh, member of RemoteUsers and of RemoteAdmins, can login on RemoteUsersProfile and on RemoteAdminProfile
So the RADIUS needs to know on which connection profile a user wants to log into. Does anybody know where in the RADIUS request the ASA puts the selected connection profile? And how does that show up on an IAS server?
Thanks!
09-18-2009 07:36 AM
Peter
This is an interesting question. For a while I wondered about doing something similar to this. But I have not been able to find any indication that the ASA passes the chosen profile/group in the authentication request to Radius. If someone can show us that this can be done it would be helpful.
HTH
Rick
09-18-2009 09:10 AM
I've sniffed the radius request coming from the ASA - there is nothing in there referring to a connection profile. I wonder if this is configurable.
09-18-2009 11:18 AM
Well, got an anwer from TAC: It is not possible. :-(
09-20-2009 01:14 PM
I'm struggling with *EXACTLY* the same issue. Having the connection profile in the RADIUS request would make perfect sense...
The best I (and Mike, my contact at Cisco) could come up with so far is to use DAP. From an AUTHENTICATION perspective, all of your users (bofh,jdoe,bigceo) can log on to any profile.
But then create DAP entries similar to:
- DAP1:
match ALL of:
connprofile RUProfile
memberof RemoteUsers
- DAP2:
match ALL of:
connprofile REProfile
memberof RemoteExecutives
- DAP3:
match ALL of:
connprofile RAProfile
memberof RemoteAdmins
- DAP4:
Terminate
That way you can use DAP to enforce ACLs.
Hope this helps...
Let me know if you come up with anything else. I'm dealing with the same issue here...
09-21-2009 10:23 AM
Why not use LDAP authentication back to your active directory (I'm assuming you're using AD because you're using IAS)? Using LDAP authentication will allow you to restrict access via groups in AD.
-Steve
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: