Group policy map with LDAP attribute, Radius Auth.

[danhed7400]

hi.

i have a working ASA5510 setup.

Today Remote users connect to the internal net, with Cisco Anyconnect. user are authenticated,based on group membership in AD, (using LDAP connection, from ASA to DC) VPN Group policys are mapped to users with LDAP Attributes, chekking AD group membership.

im in the process of implementing Vasco Security tokens, the communication between the ASA and the Vasco identikey server, goes through a RADIUS server.

so my question is, is it possible to still map users to VPN group policys, using LDAP attributs, when users validates to a RADIUS server.

[Herbert Baerten]

Hi Dan,

yes you can do double authentication (user enters username, token and AD password) or you can do Radius authentication and LDAP authorization (user enters username & token, after radius authentication the ASA then does an LDAP lookup (not an authentication) to get the attributes).

For a more complete answer see the answer to Pavel's question in this thread:

https://supportforums.cisco.com/message/3510246

hth

Herbert