topic LDAP and ASA in Network Access Control

LDAP and ASA

algorithm334411221 — Mon, 11 Mar 2019 06:05:58 GMT

Hi i am trying to get ASA to authenticate vpn users based on their AD account. i am using the following settings.

i have verified that its getting to the ldap server (DC). In cisco asdm, i see the following error:

i turned on debugging in the asa itself and i see the following error.

[-2147483629] Simple authentication for ladp_search returned code (49) Invalid credentials
[-2147483629] Failed to bind as administrator returned code (-1) Can't contact LDAP server
[-2147483629] Fiber exit Tx=223 bytes Rx=721 bytes, status=-2
[-2147483629] Session End

i then used ldp.exe tool in the DC to test the ldap_search account i was using and i was able to connect/bind and access all the OUs using the same account/password. Looks the the problem only happens if i try to connect using the ASA.

not sure what i am doing wrong or if i am missing any setting... any help would be appreciated.

thanks.

Please try username as ldap

Jagdeep Gambhir — Tue, 29 Sep 2015 16:41:29 GMT

Please try username as ldap_search@home.local and see if that fix the issue. Also make sure that user is member of account operator or domain admin group in AD.

Regards,

~JG

Do rate helpful posts

Thank you Jagdeep. i got it

algorithm334411221 — Tue, 29 Sep 2015 17:24:55 GMT

Thank you Jagdeep. i got it to work yesterday. problem was with login DN. i was using username instead of display name.

as for being part of account operator group, i think that is only required if you want to do password management over vpn. the ldap_Search account i created is just a regular user account without any special rights.

Yes, that is correct.

Jagdeep Gambhir — Sat, 03 Oct 2015 18:17:20 GMT

Yes, that is correct.