Cisco ASA 5505 Configuration Manual page 1441

Chapter 65 Configuring Dynamic Access Policies
attributes in the LDAP response message, then the group name is extracted from those attributes and
is combined with the earlier AAA memberOf attribute to form a comma separated string of group
names, also updated in the response attribute database.
In the case where the VPN remote access session to an LDAP authentication/authorization server
returns the following three Active directory groups (memberOf enumerations):
cn=Engineering,ou=People,dc=company,dc=com
cn=Employees,ou=People,dc=company,dc=com
cn=EastCoastast,ou=People,dc=company,dc=com
the ASA processes three Active Directory groups: Engineering, Employees, and EastCoast which
could be used in any combination as aaa.ldap selection criteria.
LDAP attributes consist of an attribute name and attribute value pair in the DAP record. The LDAP
attribute name is syntax/case sensitive. If for example you specify LDAP attribute Department
instead of what the AD server returns as department, the DAP record will not match based on this
attribute setting.
Note
• RADIUS—The RADIUS client stores all native RADIUS response attribute value pairs in a
database associated with the AAA session for the user. The RADIUS client writes the response
attributes to the database in the order in which it receives them. It discards all subsequent attributes
with that name. This scenario might occur when a user record and a group record are both read from
the RADIUS server. The user record attributes are read first, and always have priority over group
record attributes.
RADIUS attributes consist of an attribute number and attribute value pair in the DAP record. See
Security Appliance Supported RADIUS Attributes and Values
attributes that the security appliance supports.
Note
LDAP and RADIUS attributes include:
•
–
–
OL-20339-01
To enter multiple values in the Value field, use the semicolon (;) as the delimiter. For
example:
eng;sale; cn=Audgen VPN,ou=USERS,o=OAG
For RADIUS attributes, DAP defines the Attribute ID = 4096 + RADIUS ID.
For example:
The RADIUS attribute "Access Hours" has a Radius ID = 1, therefore DAP attribute value =
4096 + 1 = 4097.
The RADIUS attribute "Member Of" has a Radius ID = 146, therefore DAP attribute value =
4096 + 146 = 4242.
Attribute ID—Names/numbers the attribute. Maximum 64 characters.
Value—The attribute name (LDAP) or number (RADIUS).
To enter multiple values in the Value field, use the semicolon (;) as the delimiter. For example:
eng;sale; cn=Audgen VPN,ou=USERS,o=OAG
Understanding VPN Access Policies
for a table that lists RADIUS
Cisco ASA 5500 Series Configuration Guide using ASDM
65-17