×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

VPN and LDAP - multiple attributes in map

Unanswered Question
Aug 22nd, 2014
User Badges:

Hi,

I've recently configured VPN with LDAP to our Windows Server 2012. Within the LDAP Attribute Map which is assigned to the server group I have specified attribute name msNPAllowDialin and this works fine, but I was wondering if I can just add another attribute "memberOf" to the same map and specify there specific user group which should have VPN access. Will user be authenticated if both attributes are true I mean user has  "Allow access" enabled on NAP and belongs to the security group "VPN-Users"?

I've run some tests already and configured the following on my ASA 5510, but for some reason it doesn't work the way I want:) I would like to make sure that only users who belongs to "CN=MyBusiness VPN Users,OU=Security,OU=Groups,OU=MyBusiness,OU=BB Subsidiaries,DC=xxx,DC=corp" group and have NAP set to "Allow access" can authenticate. I removed user from MyBusiness VPN Users group but he was still able to authenticate.

 

Any idea how I can I fix it? 

Thank you for your help!:)

 

===snip===

ldap attribute-map LDAP2CISCO_MAP
  map-name  memberOf IETF-Radius-Class
  map-value memberOf "CN=MyBusiness VPN Users,OU=Security,OU=Groups,OU=MyBusiness,OU=BB Subsidiaries,DC=xxx,DC=corp" 6
  map-name  msNPAllowDialin IETF-Radius-Class
  map-value msNPAllowDialin "FALSE" NOACCESS
  map-value msNPAllowDialin "TRUE" ALLOWACCESS

===snip===

aaa-server agldap_ciscovpn (vlan-server) host 10.30.100.10
 server-port 389
 ldap-base-dn ou=Users,ou=MyBusiness,ou=BB Subsidiaries,dc=xxx,dc=corp
 ldap-group-base-dn OU=Security,OU=Groups,OU=MyBusiness,OU=BB Subsidiaries,DC=xxx,DC=corp
 ldap-scope subtree
 ldap-naming-attribute sAMAccountName
 ldap-login-password *****
 ldap-login-dn cn=XX ldap account,ou=Service Accounts,ou=XX Users,dc=xxx,dc=corp
 server-type microsoft
 ldap-attribute-map LDAP2CISCO_MAP
===snip===

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.

Actions

This Discussion