Cisco ASA Series Cli Configuration Manual page 2140

Configuring an External LDAP Server
•
User-Based Attributes Policy Enforcement
You can map any standard LDAP attribute to a well-known Vendor-Specific Attribute (VSA) as well as
map one or more LDAP attribute(s) to one or more Cisco LDAP attributes.
The following example shows how to configure the ASA to enforce a simple banner for a user configured
on an AD LDAP server. On the server, use the Office field in the General tab to enter the banner text.
This field uses the attribute named physicalDeliveryOfficeName. On the ASA, create an attribute map
that maps physicalDeliveryOfficeName to the Cisco attribute Banner1. During authentication, the ASA
retrieves the value of physicalDeliveryOfficeName from the server, maps the value to the Cisco attribute
Banner1, and displays the banner to the user.
This example applies to any connection type, including the IPsec VPN client, AnyConnect SSL VPN
client, or clientless SSL VPN. In the example, User1 connects through a clientless SSL VPN connection.
To configure the attributes for a user on the AD or LDAP Server, perform the following steps:
Step 1
Right-click a user.
The Properties dialog box appears (see
Step 2
Click the General tab and enter banner text in the Office field, which uses the AD/LDAP attribute
physicalDeliveryOfficeName.
Cisco ASA Series CLI Configuration Guide
1-16
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008089149
d.shtml
PIX/ASA 8.0: Use LDAP Authentication to Assign a Group Policy at Login at the following URL:
http://www.cisco.com/en/US/partner/products/ps6120/products_configuration_example09186a008
08d1a7c.shtml
Appendix 1 Configuring an External Server for Authorization and Authentication
Figure 1-3).