Ok so I have been beating my head on ASA to LDAP auth (temporary fix till my client spins up RADIUS) but thanks to the great LDAP group at Cisco TAC I”m up and working. The piont of this post is to take what we tend to know about LDAP client configs and adjust it for what Cisco has setup in PIX IOS 8.
- LDAP: OSX OpenDirector (Open LDAP in PIX IOS 8 )
- ASA 5540 in Active/Standby failover
- LDAP server in on the Inside of the ASA
BASE DN: For the most part this is what you would expect it to be. But in most of the clients I have used the Base DN is either appended automatically or you can choose to append it to your login DN, thus shortening your login DN entry. When you talk to TAC they say that your BASE DN is automatically appended to your login. Well N thats wrong. What the ASA uses the BASE DN for is the place that it starts its tree walk for Authentication or Authorization credentials only not where it looks for the BASE of it’s own credentials.
So what should you use for the BASE DN, well your BASE DN of course. So now your saying this guy is an idiot that not special at all. Well look below at what you need to use for your login DN and if that doesn’t clear things up then maybe I am an idiot.
Login DN: Normally you can stick to uid=”username”,cn=users for your login DN. But in the case of the ASA client you need to use the full login path including the base, so something like this; uid=”username”,cn=users,dc=DMS,dc=staticnat,dc=com
Another thing that seems to be unknown to TAC is whether when peforming your Auth test from the ASDM console you should use uid=”username” or just “username”. Well I have the skinny on that to, just use “username”.
The final snippet if info I have to offer on the LDAP front has to do with people who were unable to get their “asa” user to bind to the directory if it was not located withing the BASE DN. Cisco is aware of this and has patched their code. I have no idea if that patch is part of the engineering release I have or if it part of the current Pix IOS 8 ED that is available for download. I have an email out asking that question now and I hope to have an update by the end of the day. If you have any questions feel free to post to comments or email: