We currently are using LDAP to authenticate users accessing an ASA. We enforce usage of the AnyConnect client by mapping the msNPAllowDialIn LDAP attribute to the Cisco Tunneling-Protocols attribute. "Deny Access" in the A/D Dial-In tab of the user equates to a value of 0 sent to Tunneling-Protocols, which keeps non-authorized users from accessing. "Allow Access" is mapped to a "32" which enforces the use of the AnyConnect client. All is well and this works perfectly.
Now we want to create a second category of users. These users will be allowed access, but we want to use Clientless VPN, and we want to only allow TCP port forwarding to 3389 (you can see where this is going). I understand that I can map an LDAP attribute "memberOf" with a value of "VPN-RDPOnly" to the IETF-Radius-Class ASA attribute and apply a group policy of that same name which would do the trick. My question is, can I have both? I'd like to keep the "Tunneling-Protocols" attribute (which I know would have to change to 48) so that I can quickly turn off anyone I want to by allowing and disallowing through the group policy dial-in tab. But, I'd also like to have another attribute that determines which group policy is applied. So, for a given user, can the ASA evaluate both attributes (tunneling-protocols for access authorization and IETF-radius-class for policy assignment)?
