LDAP Authorization NX-OS & Catalyst

[Rem Markov]

So! Hey there!

I'm trying to set ldap in our environment to all our switches instead of TACACAS.

When trying to set ldap search map like that:

ldap search-map cisco  userprofile attribute-name "description" search-filter "(cn=$userid)" base-DN "OU=CiscoUCS,DC=ccierants,DC=com"

I'm able only to set it for users, meaning if I have a group lets say: network-pros
And I want to all of the members of this group to have network-admin permissions I'm unable, I need to go user by user and add :
shell:roles=network-admins in some random attribute. 

Why does the Authorization is like that? Why can't I set a group authorization and only user authoriation

[balaji.bandi]

There are some limitation we should accept before we using - personally i wont not use directly using LDAP (this is expose lot of information when you configuring the switch) 

instead i use NPS (if you love MS products)

refer Limitation and command syntax :

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/7-x/security/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide_7x/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide_7x_chapter_0110.html#...

[Rem Markov]

The Docs for LDAP are the worst.  But is there a way to use LDAP on ios? Is there a way to make authorization based on Group?

[balaji.bandi]

As i mentioned there are some Limitation you should understand that.

authorization is possible, but its limited (you can not get as TACACS does the things for you)

[M02@rt37]

In your case, when setting authorization for a group, you may need to loop through the users in that group and apply the necessary authorization settings. This is because LDAP, by default, doesn't provide direct mechanisms to set authorization for groups in the same way you can set it for individual users.

If you want a more group-centric approach to authorization, you may need to look into LDAP integration tools or middleware that can extend LDAP's capabilities to allow for more granular group-based authorization.

Some Identity and Access Management (IAM) solutions can provide additional features to achieve this.

Organizations use both NPS for network access control and an IAM solution to manage identities and access across a wider array of systems and applications, creating a comprehensive security framework.