11-03-2006 11:59 AM - edited 02-21-2020 01:17 AM
Hello:
I have a LDAP server configured and authentication working just fine. My next goal is to provide SSL VPN services to some employees. Their Tunnel Group membership should depend upon their LDAP 'group' membership.
For example, our LDAP administrator has configured user entries like this:
dn: uid=jdoe,ou=People,o=company.com
givenName: John
sn: Doe
mail: jdoe@company.com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: inetorgpersonsub1
uid: jdoe
cn: John Doe
description: Employee
description: Information Systems
He seems to like to use 'description' instead of OU for some reason, but that's out of my control. I assume I need to perform some sort of LDAP Attribute mapping to make this happen.
In the above example, I would like to create a Tunnel Group called 'IS' on the ASA, and if a user has 'description: Information Systems' in the ir LDAP, they would be mapped to the 'IS' tunnel group.
Can someone shed some light?
Thanks!
Mark
02-05-2007 10:31 AM
Authorization works if the object class cVPN-3000-User-Authorization is added to the schema.
How did you get Authentication working?
03-07-2007 12:24 PM
I just created an LDAP server entry, put in my Base DN, used 'uid' as my Naming Attribute, and applied the LDAP attribute Map.
The LDAP attribute map contains:
Map Name: 'uid' as Customer Name, and 'cVPN-3000-IETF-Radius-Class' as the Cisco Name.
Map Value: 'johndoe' as Customer Value, and a group policy for the Cisco Value.
Hope that helps.
Mark
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide