Is this possible ? Multi-factor authentication through a combination of RSA token and Active Directory user account and authorisation using LDAP Security Group member check for remote access VPN in ASA firewalls

[damode]

I am currently working on a POC to achieve Authentication and Authorisation for remote access VPN on ASA firewalls whereby RSA server and AD user account is used for authentication, and the LDAP - Security Group (SG) member check is used for authorisation.

Can someone please advise if the above solution is possible to achieve ? If yes, please direct to the right documentation for this.

Thanks in advance.

[Mohammed al Baqari]

You need to use DAPs to apply security rules such as ACLs based on memberOf
attribute. This is after successful authentication against LDAP/RSA which
you can do by configuring LDAP aaa-server

[damode]

Hi Mohammed,

Thanks for your response. My only main concern is whether the information retrieved about the user once RSA authenticates, would be able to accurately mapped to what LDAP can accept in order to provide authorisation for that user ?