Cisco ASA Series Cli Configuration Manual page 877

Chapter 1 Configuring AAA Servers and the Local Database
The following example shows how to define an LDAP attribute map. In this example, the security policy
specifies that users being authenticated through LDAP map the user record fields or parameters title and
company to the IETF-RADIUS service-type and privilege-level, respectively.
To define an LDAP attribute map, enter the following commands:
hostname(config)# ldap attribute-map admin-control
hostname(config-ldap-attribute-map)# map-name title IETF-RADIUS-Service-Type
hostname(config-ldap-attribute-map)# map-name company Privilege-Level
The following is sample output from the ldap-attribute-map command:
ldap attribute-map admin-control
To apply the LDAP attribute map to the LDAP AAA server, enter the following commands:
hostname(config)# aaa-server ldap-server (dmz1) host 10.20.30.1
hostname(config-aaa-server-host)# ldap-attribute-map admin-control
Note
When an authenticated user tries administrative access to the ASA through ASDM, SSH, or Telnet, but
does not have the appropriate privilege level to do so, the ASA generates syslog message 113021. This
message informs the user that the attempted login failed because of inappropriate administrative
privileges.
Using TACACS+ Authentication
For information about how to configure TACACS+ authentication, see the
TACACS+ Server" section on page
Monitoring AAA Servers
To monitor AAA servers,enter one of the following commands:
Command
show aaa-server
show running-config aaa-server
show running-config all ldap attribute-map
map-name company Privilege-Level
map-name title IETF-Radius-Service-Type
Purpose
Shows the configured AAA server statistics.
To clear the AAA server configuration, enter the clear aaa-server
statistics command.
Shows the AAA server running configuration.
To clear AAA server statistics, enter the clear configure aaa-server
command.
Shows all LDAP attribute maps in the running configuration.
To clear all LDAP attribute maps in the running configuration, use the
clear configuration ldap attribute-map command.
1-37.
Cisco ASA Series CLI Configuration Guide
Monitoring AAA Servers
"Configuring an External
1-31