Group Policy matching via LDAP Groups with MFA?

[michael3k]

Hallo,

currently we match users authenticated via LDAP to Group Policies via LDAP attribute maps by Group memberships.

In future we plan to introduce 2FA/MFA via radius. How can we still get the ldap groups and match the users to group policies?

Or is it possible to do 2FA/MFA via LDAP?

LDAP/Radius is Novell eDirectory/AAF.

[Pavan Gundu]

Assuming you are running ASA, you can capture radius attribute 25 to assign group policy.
Of course, the radius server should have radius attribute 25 configured to some OU.

Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa919/configuration/general/asa-919-general-config/aaa-radius.html#ID-2113-00000029

[michael3k]

Thank you for your help.

Yes we are running ASA and I read though the doc. So with radius there is no configurable mapping of the groups to the policy, so I assume, the attribute 25 has to have the same value as the policy name, right?

[Pavan Gundu]

Yes, attribute 25 value should exactly be the group policy name you created on the ASA.