Clientless SSL VPN - RSA & LDAP

Unanswered Question
Mar 17th, 2010


Im not sure what Im asking for is even possible. What I would like to do is have the clientless ssl vpn authenticate via RSA and LDAP at the login page. I've been able to configure it for RSA or LDAP but not both. So in the end a user would go to https://outside_int_ip and see the clientless ssl vpn login page and are required to provide username, password, and RSA token number to gain access.

Any thoughts?



I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
ksirupa Wed, 03/17/2010 - 21:50


This is possible using the double authentication feature introduced in ASA 8.2 release.

Under the "Clientless Connection Profile", you will now see "Seconday Authentication" option. 

Q: Is there any restriction? Can I have two LDAP, two RADIUS, RADIUS first then LDAP, LDAP first then RADIUS?

A: Yes, all variants are supported. However, Native RSA/SDI is not supported as the secondary authentication server. It must be configured as the primary authentication.



jickfoo Wed, 06/23/2010 - 05:59

Anyone know why RSA Cannot be configured as the secondary ?

This creates a problem for us. Our users are accustomed to putting in their id, their password, and then their PIN+Passcode.

We're forced to prompted them in reverse. This causes issues. Also it's not easily apparent on how to chance the login prompts. ie.. "Second Password" is not very helpful as a prompt.

Any inside would be greatly appreciated.


jickfoo Wed, 06/23/2010 - 06:31

I got really excited for a second but this doesnt apply to the client right ?

This is just the clientless portal ?



ksirupa Wed, 06/23/2010 - 06:34

Yes, this is limited to Clientless Portal.

From a recent exchange with developer:

We only support new pin / Next token modes on the primary  server and this is why we make that statement. You can use RSA as a secondary authentication server  if you are not using new pin / Next token modes.




This Discussion

Related Content