WEBVPN user authenticated through LDAP failure!

dugolotti — Mon, 11 Mar 2019 03:08:46 GMT

Hello,

I'm trying to configure an ASA5510 with release 9.1(1) in order to authenticate VPN AnyConnect

users through LDAP. In a first step the logs shiw me this kind of error:

[-2147483632] Session Start

[-2147483632] New request Session, context 0xadf415d4, reqType = Authentication

[-2147483632] Fiber started

[-2147483632] Creating LDAP context with uri=ldap://192.168.4.251:389

[-2147483632] Connect to LDAP server: ldap://192.168.4.251:389, status = Successful

[-2147483632] supportedLDAPVersion: value = 3

[-2147483632] supportedLDAPVersion: value = 2

[-2147483632] Binding as XUSERX

[-2147483632] Performing Simple authentication for XUSERX to 192.168.4.251

[-2147483632] Simple authentication for XUSERX returned code (8) Strong(er) authentication required

[-2147483632] Failed to bind as administrator returned code (-1) Can't contact LDAP server

[-2147483632] Fiber exit Tx=211 bytes Rx=682 bytes, status=-2

[-2147483632] Session End

ERROR: Authentication Server not responding: AAA Server has been removed

So I've changed the aaa-server configuration in order to use a different method for SASL (digest-MD5),

following the logs:

test aaa-server authentication LDAP_SRV_GRP host 192.168.4.251 usernam$

INFO: Attempting Authentication test to IP address <ipc01> (timeout: 12 seconds)

[-2147483608] Session Start

[-2147483608] New request Session, context 0xade91d2c, reqType = Authentication

[-2147483608] Fiber started

[-2147483608] Creating LDAP context with uri=ldap://192.168.4.251:389

[-2147483608] Connect to LDAP server: ldap://192.168.4.251:389, status = Successful

[-2147483608] supportedLDAPVersion: value = 3

[-2147483608] supportedLDAPVersion: value = 2

[-2147483608] Binding as XUSERX

[-2147483608] Performing SASL authentication for XUSERX to 192.168.4.251

[-2147483608] Server supports the following SASL methods: GSSAPI GSS-SPNEGO EXTERNAL DIGEST-MD5

[-2147483608] hostname = 192.168.4.251

[-2147483608] SASL authentication start with mechanism DIGEST-MD5 for XUSERX

[-2147483608] getsimple:4002 [XUSERX]

[-2147483608] getsimple:4001 [XUSERX]

[-2147483608] getsecret: [*********]

[-2147483608] SASL step for XUSERX returned code (1) another step is needed in authentication

[-2147483608] SASL authentication for XUSERX with mechanism DIGEST-MD5 rejected

[-2147483608] Failed to bind as administrator returned code (-1) Can't contact LDAP server

[-2147483608] Fiber exit Tx=616 bytes Rx=859 bytes, status=-2

[-2147483608] Session End

ERROR: Authentication Server not responding: AAA Server has been removed

It seems that I made one step forward but not solved the problem.

Could someone give me some suggestions?

Following the aaa-server configuration part:

ipcasa# sh run aaa-server

aaa-server LDAP_SRV_GRP protocol ldap

reactivation-mode depletion deadtime 1

aaa-server LDAP_SRV_GRP (corporate) host ipc01

server-port 389

ldap-base-dn dc=ipc, dc=local

ldap-scope subtree

ldap-login-password *****

ldap-login-dn cn=XUSERX, cn=users, dc=ipc, dc=local

sasl-mechanism digest-md5

server-type microsoft

aaa-server LDAP_SRV_GRP (corporate) host 192.168.4.253

server-port 389

ldap-base-dn dc=ipc, dc=it

ldap-scope subtree

ldap-login-password *****

ldap-login-dn cn=XUSERX, cn=users, dc=ipc, dc=local

sasl-mechanism digest-md5

server-type microsoft

aaa-server KRB01 protocol kerberos

aaa-server KRB01 (corporate) host 192.168.4.253

kerberos-realm IPC.LOCAL

Thanks in advance for any suggestions!

Denni

Any resolution?

Keith Wood — Mon, 11 May 2015 16:54:22 GMT

Any resolution?

I'm pretty sure you need to

jan.nielsen — Tue, 12 May 2015 14:16:03 GMT

I'm pretty sure you need to use LDAP over SSL (port 686 i think), to have that work.

topic Any resolution? in Network Access Control

WEBVPN user authenticated through LDAP failure!

Any resolution?

I'm pretty sure you need to