FTD w/ Duo and LDAP Attribute Map

[mumbles202]

Is it possible to integrate Duo into a deployment w/ a working LDAP attribute map configuration.  Currently it's setup w/ the default map providing no access, and members of group 1 or group 2 get different access.  Would like to now add Duo integration so wanted to confirm if we'd still be able to maintain this setup, just using Duo as the authenticator rather than the current LDAP.  

Also, if anyone knows, if not all users will be migrated to Duo during testing is the best approach to simply create a 2nd connection profile and use the Duo proxy there?  That way users who don't have MFA enabled can still access the systems until they are able to be migrated.

[marce1000]

 - Check if this document can be helpful :

             https://community.cisco.com/t5/security-documents/duo-integration-options-for-cisco-anyconnect-vpn-with-asa-and/ta-p/4114832

 M.

[mumbles202]

Thanks for the link.  So it looks as though in this scenario I'd have to use the option for Duo Authentication Proxy and LDAP in order to maintain the attribute map?