I am attempting to setup Microsoft LDAP authentication, for SSH only, for a specific security group on a Cisco ASA 5585 version 8.2(5) using the ASDM. The lookup and authentication is working, however all users are authenticated regardless of security group membership.
AAA Config:
aaa-server LDAP_mybusinessda (web) host 10.100.21.6
server-port 636
ldap-base-dn OU=Staff Users,OU=mybusiness,DC=mybusinessda,DC=org
ldap-naming-attribute sAMAccountName
ldap-login-password *****
ldap-login-dn CN=LDAPLookup,CN=Users,DC=mybusinessda,DC=org
ldap-over-ssl enable
ldap-attribute-map LDAP_memberOf_ServiceType
aaa authentication enable console LDAP_mybusinessda LOCAL
aaa authentication ssh console LDAP_mybusinessda LOCAL
ldap attribute-map LDAP_memberOf_ServiceType
map-name memberOf IETF-Radius-Service-Type
map-value memberOf CN=CiscoASAManagement,OU=Security,OU=Groups,OU=mybusiness,DC=mybusinessda,DC=org 6
When I connect with a user who is a member of the group, the LDAP debug shows (only pasting relevant portion:
[3185] Creating LDAP context with uri=ldaps://10.100.21.6:636
[3185] Connect to LDAP server: ldaps://10.100.21.6:636, status = Successful
[3185] supportedLDAPVersion: value = 3
[3185] supportedLDAPVersion: value = 2
[3185] Binding as LDAPLookup
[3185] Performing Simple authentication for LDAPLookup to 10.100.21.6
[3185] LDAP Search:
Base DN = [OU=Staff Users,OU=mybusiness,DC=mybusinessda,DC=org]
Filter = [sAMAccountName=test_allowed_user]
Scope = [ONE LEVEL]
[3185] User DN = [CN=TestAllowedUser,OU=Staff Users,OU=mybusiness,DC=mybusinessda,DC=org]
[3185] Talking to Active Directory server 10.100.21.6
[3185] Binding as test_allowed_user
[3185] Performing Simple authentication for test_allowed_user to 10.100.21.6
[3185] Processing LDAP response for user test_allowed_user
[3185] Message (test_allowed_user):
[3185] Authentication successful for test_allowed_user to 10.100.21.6
[3185] Retrieved User Attributes:
[3185] memberOf: value = CN=CiscoASAManagement,OU=Security,OU=Groups,OU=mybusiness,DC=mybusinessda,DC=org
[3185] mapped to IETF-Radius-Service-Type: value = 6
Even if I remove the ldap-attribute-map from the aaa-server, all users are still authenticated, and the debug simply doesn't show the mapped to IETF-Radius-Service-Type. What is wrong here?
Also, I can't tag this LDAP because of my rep. Unfortunate.
EDIT:
I may end up doing this with RADIUS, as the rest of the Cisco devices support RADIUS auth and it would unify all my Cisco devices. It appears this method of LDAP auth may only work for VPN also.
Best Answer
EDIT: Oops, I just re-read your question and I believe you are hoping to limit who can SSH to your ASA using the "ldap-attribute-map". As far as I know, the LDAP Attribute Map feature is only used for modifying VPN access, not management access to the ASA itself. I'll leave my original answer below in case you (or anyone else) finds it helpful)
The LDAP attribute map allows you to 'override' policies that are inherited from the "default-group-policy" command in the tunnel group for this particular VPN. So in essence, what you need to do is have it so the default-group-policy allows no access, but group-policy 6 allows full access (or whatever access you desire).
Without seeing the rest of your configuration, its hard to give you exact configurations you will need, but here is an effective summary:
This will make it so that anyone that authenticates against your tunnel group is not allowed to connect... EXCEPT if they match your LDAP attribute map which overrides the "simultaneous logins" setting from 0 to 1.