Solved: Confusion regarding how to implement DAP

snyggsomfan · ‎10-22-2011

Hi everybody,

Today we have a simple ASA-5520 SVC setup with just one connection profile and one group policy. Authentication (2 factor – AD + SMS) is performed by RADIUS. We would now like allow access to this VPN service only if you reside in a particular group in the MS AD. From what I understand this can be accomplished through DAP. Either by matching the LDAP attribute “memberOf” or RADIUS id 146. I’m I right? Can I still perform authentication using RADIUS and then DAP using LDAP or must I use DAP using RADIUS?

/K

Herbert Baerten · ‎10-24-2011

Hi Patrik,

DAP does not contact any AAA server to get user attributes, instead it uses the attributes received during the regulare authentication and authorization stages.

So in your case you have 3 options:

- use only radius attributes in your DAP policy (but whether or not you can use attribute 146 depends on whether your radius server sends this attribute, check "debug radius")

- replace radius authentication with LDAP authentication; I guess you can't do that because you need radius for the SMS stuff.

- keep radius authentication and add LDAP authorization; i.e. after a successful radius authentication, the ASA will then query the LDAP server for user attributes.

hth

Herbert

View solution in original post

Herbert Baerten · ‎10-24-2011

Hi Patrik,

DAP does not contact any AAA server to get user attributes, instead it uses the attributes received during the regulare authentication and authorization stages.

So in your case you have 3 options:

- use only radius attributes in your DAP policy (but whether or not you can use attribute 146 depends on whether your radius server sends this attribute, check "debug radius")

- replace radius authentication with LDAP authentication; I guess you can't do that because you need radius for the SMS stuff.

- keep radius authentication and add LDAP authorization; i.e. after a successful radius authentication, the ASA will then query the LDAP server for user attributes.

hth

Herbert

snyggsomfan · ‎10-25-2011

OK, thanks Herbert!

One final question regarding the third option - "keep radius authentication and add LDAP authorization". Do you mean the authorization option in the tunnel-group?

/Patrik

Herbert Baerten · ‎10-25-2011

One final question regarding the third option - "keep radius authentication and add LDAP authorization". Do you mean the authorization option in the tunnel-group?

Yes that's correct.

e.g.

aaa-server ldap protocol myldap

aaa-server ldap host 10.x.x.x

ldap-base-dn cn=users,dc=MYDOMAIN,dc=COM

ldap-scope onelevel

ldap-login-password *

ldap-login-dn ldapadmin

server-type microsoft

...

tunnel-group myTG general-attributes

authentication-server-group myradius

authorization-server-group myldap

cheers

Herbert