Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Cisco ASA - Microsoft LDAP authentication

Dear all,

I have configured ASA as a client for LDAP authentication when remote access vpn is in use.

Almost everything works fine. I mean, I can login to network, I can get some attributes located in LDAP, etc.

But I have met problem.

When login name is in format : login-name only, everything works fine.

When login name is in format : domain\login-name, everything crashes

test aaa-server authentication LDAP-AD host username help password xxxx

INFO: Attempting Authentication test to IP address <> (timeout: 12 seconds)

[9064] Session Start

[9064] New request Session, context 0x749ad428, reqType = Authentication

[9064] Fiber started

[9064] Creating LDAP context with uri=ldaps://

[9064] Connect to LDAP server: ldaps://, status = Successful

[9064] supportedLDAPVersion: value = 3

[9064] supportedLDAPVersion: value = 2

[9064] Binding as pokus

[9064] Performing Simple authentication for pokus to

[9064] LDAP Search:

        Base DN = [dc=domain,dc=local]

        Filter  = [sAMAccountName=domain\\help]

        Scope   = [SUBTREE]

[9064] User domain\help not found

[9064] Fiber exit Tx=302 bytes Rx=790 bytes, status=-1

[9064] Session End

ERROR: Authentication Rejected: User was not found

Did anyone met this situation? And does anybody know, how to handle, with this?


New Member

Cisco ASA - Microsoft LDAP authentication

I believe the filter line is the issue. sAMAccountName will not have \. Just the user name. In the naming attributes field all you should have in that block is samaccountname and nothing more. When you log in, you don't specify a domain. If you want to specify a domain, you need to use a different field. Since no field in AD has \ I don't know how you could correct that. I believe userPrincipalName is the closest attribute you could try, though that would use @...

CreatePlease login to create content