3

I am attempting to setup Microsoft LDAP authentication, for SSH only, for a specific security group on a Cisco ASA 5585 version 8.2(5) using the ASDM. The lookup and authentication is working, however all users are authenticated regardless of security group membership.

AAA Config:

aaa-server LDAP_mybusinessda (web) host 10.100.21.6
 server-port 636
 ldap-base-dn OU=Staff Users,OU=mybusiness,DC=mybusinessda,DC=org
 ldap-naming-attribute sAMAccountName
 ldap-login-password *****
 ldap-login-dn CN=LDAPLookup,CN=Users,DC=mybusinessda,DC=org
 ldap-over-ssl enable
 ldap-attribute-map LDAP_memberOf_ServiceType
aaa authentication enable console LDAP_mybusinessda LOCAL
aaa authentication ssh console LDAP_mybusinessda LOCAL
ldap attribute-map LDAP_memberOf_ServiceType
  map-name  memberOf IETF-Radius-Service-Type
  map-value memberOf CN=CiscoASAManagement,OU=Security,OU=Groups,OU=mybusiness,DC=mybusinessda,DC=org 6

When I connect with a user who is a member of the group, the LDAP debug shows (only pasting relevant portion:

[3185] Creating LDAP context with uri=ldaps://10.100.21.6:636
[3185] Connect to LDAP server: ldaps://10.100.21.6:636, status = Successful
[3185] supportedLDAPVersion: value = 3
[3185] supportedLDAPVersion: value = 2
[3185] Binding as LDAPLookup
[3185] Performing Simple authentication for LDAPLookup to 10.100.21.6
[3185] LDAP Search:
        Base DN = [OU=Staff Users,OU=mybusiness,DC=mybusinessda,DC=org]
        Filter  = [sAMAccountName=test_allowed_user]
        Scope   = [ONE LEVEL]
[3185] User DN = [CN=TestAllowedUser,OU=Staff Users,OU=mybusiness,DC=mybusinessda,DC=org]
[3185] Talking to Active Directory server 10.100.21.6
[3185] Binding as test_allowed_user
[3185] Performing Simple authentication for test_allowed_user to 10.100.21.6
[3185] Processing LDAP response for user test_allowed_user
[3185] Message (test_allowed_user):
[3185] Authentication successful for test_allowed_user to 10.100.21.6
[3185] Retrieved User Attributes:
[3185]  memberOf: value = CN=CiscoASAManagement,OU=Security,OU=Groups,OU=mybusiness,DC=mybusinessda,DC=org
[3185]          mapped to IETF-Radius-Service-Type: value = 6

Even if I remove the ldap-attribute-map from the aaa-server, all users are still authenticated, and the debug simply doesn't show the mapped to IETF-Radius-Service-Type. What is wrong here?

Also, I can't tag this LDAP because of my rep. Unfortunate.

EDIT:
I may end up doing this with RADIUS, as the rest of the Cisco devices support RADIUS auth and it would unify all my Cisco devices. It appears this method of LDAP auth may only work for VPN also.

Improve this question
2
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 8, 2017 at 16:33
  • Unfortunately, no. I ended up using TACACS with a Cisco ACS appliance to interface with MS AD. I do not have confirmation what I wanted was unsupported, but I will update with an answer.
    – Ben
    Aug 8, 2017 at 20:46

3 Answers 3

Reset to default
1

EDIT: Oops, I just re-read your question and I believe you are hoping to limit who can SSH to your ASA using the "ldap-attribute-map". As far as I know, the LDAP Attribute Map feature is only used for modifying VPN access, not management access to the ASA itself. I'll leave my original answer below in case you (or anyone else) finds it helpful)

The LDAP attribute map allows you to 'override' policies that are inherited from the "default-group-policy" command in the tunnel group for this particular VPN. So in essence, what you need to do is have it so the default-group-policy allows no access, but group-policy 6 allows full access (or whatever access you desire).

Without seeing the rest of your configuration, its hard to give you exact configurations you will need, but here is an effective summary:

tunnel-group TG-SVC-VPN type remote-access
tunnel-group TG-SVC-VPN general-attributes
  authentication-server-group LDAP_mybusinessda
  default-group-policy GP-SVC-NO-ACCESS
tunnel-group TG-SVC-VPN webvpn-attributes
  group-alias Default enable

group-policy GP-SVC-NO-ACCESS internal
group-policy GP-SVC-NO-ACCESS attributes
  vpn-simultaneous-logins 0

group-policy 6 internal
group-policy 6 attributes
  vpn-simultaneous-logins 1
  [vpn-filter ...]
  [ip pool ...]
  [etc]

This will make it so that anyone that authenticates against your tunnel group is not allowed to connect... EXCEPT if they match your LDAP attribute map which overrides the "simultaneous logins" setting from 0 to 1.

Improve this answer
1
  • Indeed. I am looking for SSH auth only. This box doesn't host VPN. I will edit it to make the SSH portion a little more clear, as its only mentioned in the title.
    – Ben
    Apr 9, 2014 at 14:41
1

I was unable to make this work directly. In the end, we used AAA, TACACS, and Cisco ACS to interface with Microsoft Active Directory. The ASA checks with ACS when you submit login credentials, and then ACS verifies the creds and group membership against AD for both authentication and authorization.

I do not necessarily have confirmation that my original question is unsupported, but this was the easiest way for us to make SSH authentication work with AD credentials. RADIUS could likely accomplish the same result.

Improve this answer
0

looking at our config it seems like all you need to actually get this working is to put the DN of the group in inverted commas in the map-value command:

ldap attribute-map LDAP_memberOf_ServiceType
  map-name  memberOf IETF-Radius-Service-Type
  map-value memberOf "CN=CiscoASAManagement,OU=Security,OU=Groups,OU=mybusiness,DC=mybusinessda,DC=org" 6

this is the link iused to get ours right: https://lessonsintech.wordpress.com/2018/04/20/asa-auth-ad/

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.