Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

ASA & LDAP Authorization

Hello:

I have a LDAP server configured and authentication working just fine. My next goal is to provide SSL VPN services to some employees. Their Tunnel Group membership should depend upon their LDAP 'group' membership.

For example, our LDAP administrator has configured user entries like this:

dn: uid=jdoe,ou=People,o=company.com

givenName: John

sn: Doe

mail: jdoe@company.com

objectClass: top

objectClass: person

objectClass: organizationalPerson

objectClass: inetOrgPerson

objectClass: inetorgpersonsub1

uid: jdoe

cn: John Doe

description: Employee

description: Information Systems

He seems to like to use 'description' instead of OU for some reason, but that's out of my control. I assume I need to perform some sort of LDAP Attribute mapping to make this happen.

In the above example, I would like to create a Tunnel Group called 'IS' on the ASA, and if a user has 'description: Information Systems' in the ir LDAP, they would be mapped to the 'IS' tunnel group.

Can someone shed some light?

Thanks!

Mark

  • Other Security Subjects
2 REPLIES
New Member

Re: ASA & LDAP Authorization

Authorization works if the object class cVPN-3000-User-Authorization is added to the schema.

How did you get Authentication working?

New Member

Re: ASA & LDAP Authorization

I just created an LDAP server entry, put in my Base DN, used 'uid' as my Naming Attribute, and applied the LDAP attribute Map.

The LDAP attribute map contains:

Map Name: 'uid' as Customer Name, and 'cVPN-3000-IETF-Radius-Class' as the Cisco Name.

Map Value: 'johndoe' as Customer Value, and a group policy for the Cisco Value.

Hope that helps.

Mark

317
Views
0
Helpful
2
Replies
This widget could not be displayed.