I am attempting to setup Microsoft LDAP authentication, for SSH only, for a specific security group on a Cisco ASA 5585 version 8.2(5) using the ASDM. The lookup and authentication is working, however all users are authenticated regardless of security group membership.
aaa-server LDAP_mybusinessda (web) host 10.100.21.6 server-port 636 ldap-base-dn OU=Staff Users,OU=mybusiness,DC=mybusinessda,DC=org ldap-naming-attribute sAMAccountName ldap-login-password ***** ldap-login-dn CN=LDAPLookup,CN=Users,DC=mybusinessda,DC=org ldap-over-ssl enable ldap-attribute-map LDAP_memberOf_ServiceType aaa authentication enable console LDAP_mybusinessda LOCAL aaa authentication ssh console LDAP_mybusinessda LOCAL ldap attribute-map LDAP_memberOf_ServiceType map-name memberOf IETF-Radius-Service-Type map-value memberOf CN=CiscoASAManagement,OU=Security,OU=Groups,OU=mybusiness,DC=mybusinessda,DC=org 6
When I connect with a user who is a member of the group, the LDAP debug shows (only pasting relevant portion:
 Creating LDAP context with uri=ldaps://10.100.21.6:636  Connect to LDAP server: ldaps://10.100.21.6:636, status = Successful  supportedLDAPVersion: value = 3  supportedLDAPVersion: value = 2  Binding as LDAPLookup  Performing Simple authentication for LDAPLookup to 10.100.21.6  LDAP Search: Base DN = [OU=Staff Users,OU=mybusiness,DC=mybusinessda,DC=org] Filter = [sAMAccountName=test_allowed_user] Scope = [ONE LEVEL]  User DN = [CN=TestAllowedUser,OU=Staff Users,OU=mybusiness,DC=mybusinessda,DC=org]  Talking to Active Directory server 10.100.21.6  Binding as test_allowed_user  Performing Simple authentication for test_allowed_user to 10.100.21.6  Processing LDAP response for user test_allowed_user  Message (test_allowed_user):  Authentication successful for test_allowed_user to 10.100.21.6  Retrieved User Attributes:  memberOf: value = CN=CiscoASAManagement,OU=Security,OU=Groups,OU=mybusiness,DC=mybusinessda,DC=org  mapped to IETF-Radius-Service-Type: value = 6
Even if I remove the
ldap-attribute-map from the
aaa-server, all users are still authenticated, and the debug simply doesn't show the
mapped to IETF-Radius-Service-Type. What is wrong here?
Also, I can't tag this LDAP because of my rep. Unfortunate.
I may end up doing this with RADIUS, as the rest of the Cisco devices support RADIUS auth and it would unify all my Cisco devices. It appears this method of LDAP auth may only work for VPN also.