VPN LDAP Authorization Failure

[matthew.rand]

I have set up VPN certificate authentication/authorization on an ASA5520.  I am not having any problems with the authentication part, but, I am having an issue with authorization.  Users get authorization through LDAP to our AD network, however, we have some users which get “%ASA-6-113005: AAA user authorization Rejected : reason = User was not found : server =”.  This is just happening to some and not all users.

I have captured the log files and compared the username being sent via ldap is the same as what is listed for their username on the DC.  The users are able to log onto the domain with no problem they are just unable to get authorization through VPN, they have dial-in permissions and what I have been able to tell the basic groups are the same.  They have attempted to log on through different computer systems, it makes no difference.

What could be the problem where some are able to get authorization and others are not? 

[matthew.rand]

Solved the problem.

The configuration of the ldap-base-dn statement under the aaa-server policy was not pointing at a high enough OU level.  Once I changed it users were able to connect.

[brettmoore99]

I found this discussion when I was having the exact same problem, it turned out that in the ldap server configuration page is was looking for SAMAccountName and the certificate was passing userPrincipalName, I changed the relevant field to now look for the UPN and all is working perfectly now...

Just in case anyone else should have the same problem! The logs where showing that the asa was trying to authenticate testuser@domain.com and the LDAP server was returning user does not exist, this makes sense as SAMAccountName only has the testuser attribute, not the full testuser@domain.com...