Ldap Server Support; Authentication With Ldap - Cisco FirePOWER ASA 5500 series Configuration Manual

AAA Server and Local Database Support

LDAP Server Support

This section describes using an LDAP directory with the security appliance for user authentication and
VPN authorization. This section includes the following topics:
•
•
•
For example configuration procedures used to set up LDAP authentication or authorization, see
Appendix E, "Configuring an External Server for Authorization and

Authentication with LDAP

During authentication, the security appliance acts as a client proxy to the LDAP server for the user, and
authenticates to the LDAP server in either plain text or using the Simple Authentication and Security
Layer (SASL) protocol. By default, the security appliance passes authentication parameters, usually a
username and password, to the LDAP server in plain text. Whether using SASL or plain text, you can
secure the communications between the security appliance and the LDAP server with SSL using the
ldap-over-ssl command.
If you do not configure SASL, we strongly recommend that you secure LDAP communications with
Note
SSL. See the ldap-over-ssl command in the Cisco Security Appliance Command Reference.
When user LDAP authentication has succeeded, the LDAP server returns the attributes for the
authenticated user. For VPN authentication, these attributes generally include authorization data which
is applied to the VPN session. Thus, using LDAP accomplishes authentication and authorization in a
single step.
Securing LDAP Authentication with SASL
The security appliance supports the following SASL mechanisms, listed in order of increasing strength:
•
•
You can configure the security appliance and LDAP server to support any combination of these SASL
mechanisms. If you configure multiple mechanisms, the security appliance retrieves the list of SASL
mechanisms configured on the server and sets the authentication mechanism to the strongest mechanism
configured on both the security appliance and the server. For example, if both the LDAP server and the
security appliance support both mechanisms, the security appliance selects Kerberos, the stronger of the
mechanisms.
The following example configures the security appliance for authentication to an LDAP directory server
named ldap_dir_1 using the digest-MD5 SASL mechanism, and communicating over an SSL-secured
connection:
hostname(config)# aaa-server ldap_dir_1 protocol ldap
hostname(config-aaa-server-group)# aaa-server ldap_dir_1 host 10.1.1.4
hostname(config-aaa-server-host)# sasl-mechanism digest-md5
hostname(config-aaa-server-host)# ldap-over-ssl enable
Cisco Security Appliance Command Line Configuration Guide
13-6
Authentication with LDAP, page 13-6
Authorization with LDAP for VPN, page 13-7
LDAP Attribute Mapping, page 13-8
Digest-MD5 — The security appliance responds to the LDAP server with an MD5 value computed
from the username and password.
Kerberos — The security appliance responds to the LDAP server by sending the username and realm
using the GSSAPI (Generic Security Services Application Programming Interface) Kerberos
mechanism.
Chapter 13 Configuring AAA Servers and the Local Database
Authentication".
OL-10088-01