ISE Admin Access Authentication against multiple AD/LDAP Identity Sources

Hi all!
We would like to grant admin cccess to our ISE deplyoment to users stored in multiple Active Directories. Since there is no trust relationship between these ADs, we created an LDAP Identity Source for each AD and also an Identity Source Sequence but in the UI we can only select one Identity Source.
Any ideas how to solve this problem?
Thanks in advance!
Kind regards,
Michael Langerreiter

I did check in my lab and yes for admin access we can't select identity store sequence in authentication. We can only pick one external database. However, on the login page you may select the appropriate database before you enter the username and password.
Jatin Katyal
- Do rate helpful posts -

Similar Messages

  • ISE admin access, authentication against external radius

    Please don't ask me why,
    the customer insists and wants to be authenticated on ise (as admin) against an external (microsoft) radius server
    is it possible while retaining internal admin users database in a sequence Internal>external_radius or internal>AD ?
    thank you in advance for whatever may help

    According to Cisco:
    External Authentication AND external Authorisation for Admin acces son the ISE can only be done by using LDAP or AD.
    For Radius Servers there are a solution for external Authentication and internal Authorisation on the ise:
    External Authentication + Internal Authorization
    When configuring Cisco ISE to provide administrator authentication using an external RSA SecurID identity store, administrator credential authentication is performed by the RSA identity store. However, authorization (policy application) is still done according to the Cisco ISE internal database. In addition, there are two important factors to remember that are different from External Authentication + External Authorization:
    You do not need to specify any particular external administrator groups for the administrator.
    You must configure the same username in both the external identity store and the local Cisco ISE database.
    To create a new Cisco ISE administrator that authenticates via the external identity store, complete the following steps:
    Step 1 Choose Administration > System > Admin Access > Administrators > Local Administrators.
    The Administrators window appears, listing all existing locally defined administrators.
    Step 2 Follow the guidelines at Creating a New Cisco ISE Administrator to ensure that the administrator username on the external RSA identity store is also present in Cisco ISE. Be sure to click the External option under Password.
    Note Remember: you do not need to specify a password for this external administrator user ID, nor are you required to apply any specially configured external administrator group to the associated RBAC policy.
    Step 3 Click Save .

  • ISE Admin Access Authentication to RADIUS Token Server

    Hi all!
    I want to use an External  RADIUS Token Server for ISE Admin Access Authentication and Authorization.
    Authentication works, but how do I map the users  to Admin Groups? Is there a way  to map a returned RADIUS Attribute  (IETF "Class" or Cisco-AVPair "CiscoSecure-Group-Id") to an Admin Group?
    Thanks in advance,
    Michael Langerreiter

    ISE 1.3 does have an bug: Authentication failed due to zero RBAC Groups.
    Cisco Bug: CSCur76447 - External Admin access fails with shadow user & Radius token
    Last Modified
    Nov 25, 2014
    Product
    Cisco Identity Services Engine (ISE) 3300 Series Appliances
    Known Affected Releases
    1.3(0.876)
    Description (partial)
    Symptom:
    ISE 1.3 RBAC fails with shadow user & Radius token
    Operations > Reports > Deployment Status > Administrator Logins report shows
    Authentication failed due to zero RBAC Groups
    Conditions:
    RBAC with shadow user & Radius token
    View Bug Details in Bug Search Tool
    Why Is Login Required?
    Bug details contain sensitive information and therefore require a Cisco.com account to be viewed.
    Bug Details Include
    Full Description (including symptoms, conditions and workarounds)
    Status
    Severity
    Known Fixed Releases
    Related Community Discussions
    Number of Related Support Cases
    Bug information is viewable for customers and partners who have a service contract. Registered users can view up to 200 bugs per month without a service contract.

  • Cisco ACS 5.2 authentication against multiple LDAP servers

    Hi Folks,
    I have a wireless network that uses ACS 5.2 to handle authentication.   The ACS is integrated with an Active Directory LDAP server (my_ldap) and is working correctly at the moment.    The authentication flow looks like this:
     - User tries to associate to WLAN
     - Authentication request is sent to ACS
     - Service selection rule chooses an access-policy (wireless_access_policy)
     - wireless_access_policy is configured to use my_ldap as identity source.
    A sister company is about to move into our offices, and will need access to the same WLAN.    Users in the sister company are members of a separate AD domain (sister_company_ldap).    I would like to modify the wireless_access_policy so that when it receives an authentication request it will query both my_ldap and sister_company_ldap, and return a passed authentication if either attempt is successful.     Is this possible?

    Assuming you're already authenticating using your AD binding and AD1 as your identity source, you can add a further LDAP server as another identity source and add this to your identity store sequence in your access policy to authenticate against both.
    You can also add multiple LDAP servers and add them both to the identity store sequence (if you're not using AD1).

  • Identity Service Engine (ISE) Admin Access

    Is it possible to authenticate the ISE administrator via an external Radius Server? The option I find is that it will not work, 
    The manual reads: 
    In Cisco ISE, you can authenticate administrators via an external identity store such as Active Directory, LDAP, or RSA SecureID. There are two models you can use to provide authentication via an external identity store:
    Is this the case ?

    Sure you can!
    Make sure you have the RADIUS server added to the ISE (Administration > Identity Management > External Identity Sources  Select RADIUS Token from the left menu).
    Then head over to Administration > System > Admin Access.  Change the * Identity Source to your RADIUS Server and click Save
    Log out and you will see an new entry on the log in screen.  Click the dropdown for Identity Source and choose your RADIUS Server.  If this connection gets dropped for any reason, you can always log in using the internal identity source as a fallback.
    Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question.  Otherwise, feel free to post follow-up questions.
    Charles Moreton

  • ISE Admin Access with AD Credentials fails after upgrade 1.2.1 to 1.3.0

    Hello,
    After upgrading ISE VM from 1.2.1 to 1.3.0.876, I can't connect on ISE with AD Credentials (Invalid Username or Password). It worked find before upgrading to 1.3.
    On another ISE VM in 1.3.0.876 version (w/o upgrade) with this kind of configuration, it's OK.
    I have double check the Post-upgrade tasks (particularly rejoining Active Directory). Everything worked find after this upgrade except the admin access with AD credentials.
    I don't use user certificate-based authentication for admin access. So I didn't execute application start ise safe CLI.
    My 802.1x wireless users passed authentication with AD credentials. So the ISE had correctly join my AD.
    I didn't find anything related to this admin access with AD credentials failure in the output of show logging application ise and show logging.
    I don't find anything related to this in bug search on Cisco tools.
    I tried to :
    - update the SID of my Admin AD Group, the result is still the same.
    - delete my admin access with AD credentials configuration then make this configuration again, but still the same error.
    Any ideas on this ? Could I find elements in another log ?
    Regards.

    Dear Markus,
    After logging as user "prdadm"
    su - prdadm
    bssltests% bash-3.00$ ls -a
    .                            .dbenv_bssltests.sh-old      .sapenv_bssltests.sh         startdb.log
    ..                           .dbenv_bssltests.sh-old10    .sapenv_bssltests.sh-new     startsap_.log
    .bash_history                .dbsrc_bssltests.csh         .sapenv_bssltests.sh-old10   startsap_DVEBMGS00.log
    .cshrc                       .dbsrc_bssltests.sh          .sapsrc_bssltests.csh        startsap_DVEBMGS01.log
    .dbenv_bssltests.csh         .login                       .sapsrc_bssltests.sh         stopdb.log
    .dbenv_bssltests.csh-new     .profile                     dev_sapstart                 stopsap_.log
    .dbenv_bssltests.csh-old     .sapenv_bssltests.csh        local.cshrc                  stopsap_DVEBMGS00.log
    .dbenv_bssltests.csh-old10   .sapenv_bssltests.csh-new    local.login                  stopsap_DVEBMGS01.log
    .dbenv_bssltests.sh          .sapenv_bssltests.csh-old    local.profile                trans.log
    .dbenv_bssltests.sh-new      .sapenv_bssltests.csh-old10  sqlnet.log
    bash-3.00$
    bash-3.00$
    I have changed envt settings in .dbenv_bssltests.csh & .dbenv_bssltests.sh
    .sapenv_bssltests.sh & .sapenv_bssltests.csh  [4 files]
    Regards,
    Ankita

  • Multiple AD External Identity Sources in ISE 1.2

    First I guess is it possible to have multiple AD entries for External Identity Sources in ISE 1.2? When I display Active Directory (AD1) it displays my four ISE servers with a status of connected but I see no where to add anything additional. I did not originally set this up so figure I am missing something somewhere if this is possible. I though maybe add under LDAP and then it would roll into AD or something but I have nothing listed under LDAP either.
    What I am trying to do is figure out how to have ISE cover our two different domains. We ahve one big forest but currently that is split into two AD domains based upon our two divisions.  am trying to see if possibly I can simply get through the existing configuration to pull security groups from the other domain into the dictionary but so far that has proven not do able.
    Brent

    Saurav,
    I was beginning to think that might be the solution. Now I just need to go through the release notes and make sure there are no issues with it running on ACS-2111 appliance. We are currently using this as the secondary Admin but knew we would have to move off something. I think management is hoping later than sooner especially since we are still in that initial roll out phase.
    How does the system handle the fact that this is all centralized but I have users authenticating from the different time zones? I have been reading about everything pointing to the same NTP server but took that to simply be the servers in the ISE Cluster. Will this also impact all the switches and network devices involved in the authentication process?
    Brent

  • ISE 1.2 Admin Access via Active Directory

    Hi Experts,
    Good Day!
    I want to configure my ISE 1.2 to authenticate (for admin) against the active directory. I know it is possible but our AD doesn't have any groups named for admins.
    Is it possible for the ISE 1.2 to configure a local user ID and check it to the AD for the password of the UserID?
    Thanks for your great help.
    niks

    Niks,
    I just got done doing this.  First of all you have to have the Active Directory setup as an external data source.  Once you do that Click on Administration - - Admin Access.
    For the Authentication Type ensure that Password Based is toggled and change your data source to Active Directory (or whatever you named it).
    Then click in Administrators - - Admin Users.  Click Add a user - - Create Admin User.  Ensure to check the External box and you will notice the Password field goes away.  Fill out the appropriate information and then assign them to an Admin Group.
    Once you are done with that you can test that user by logging out of your ISE session.  You will notice that when you try to log back in you will have a choice of the data sources used to authenticate the user.  Change the selection to Active Directory and enter the AD user/password for the newly created account you should be good to go.
    Make sure that you don't delete or disable your original admin account in this process.  (Change the password if you like.)

  • ISE 1.2 - 24492 Machine authentication against AD has failed

    Currently experiencing a machine authentication problem between ISE 1.2 patch 2 and a customer AD installation.
    AuthZ policy is set to match agains /Users/Domain Computers and /Users Domain Users.  User authentication works, machine auth doesnt.
    Machine authentication box is ticked.
    If you try to disable an AD machine, or try a machine not in the domain you get the appropriate different response in the ISE logs which sugests it has the right access into AD to check this info.
    This happens on all computers, both WinXP and Win7 corporate builds.
    I know its not an ISE policy configuration as I have resorted to testing the same ISE against a vanilla lab AD environment with the same AD domain name (just by changing the DNS servers ISE uses) and the computer lookup works!
    Anybody got any ideas?
    thanks.

    24492
    External-Active-Directory
    Machine   authentication against Active Directory has failed
    Machine   authentication against Active Directory has failed.
    Error
    Please check NTP is in sync or not  ISE

  • ISE 1.1 - 24492 Machine authentication against AD has failed

    We implement Cisco ISE 802.1X and Machine Authentication With EAP-TLS.
    Authentication Summary
    Logged At:
    March 11,2015 7:00:13.374 AM
    RADIUS Status:
    RADIUS Request dropped : 24492 Machine authentication against Active Directory has failed
    NAS Failure:
    Username:
    [email protected]
    MAC/IP Address:
    00:26:82:F1:E6:32
    Network Device:
    WLC : 192.168.1.225 :  
    Allowed Protocol:
    TDS-PEAP-TLS
    Identity Store:
    AD1
    Authorization Profiles:
    SGA Security Group:
    Authentication Protocol :
    EAP-TLS
     Authentication Result
    RadiusPacketType=Drop
     AuthenticationResult=Error
     Related Events
     Authentication Details
    Logged At:
    March 11,2015 7:00:13.374 AM
    Occurred At:
    March 11,2015 7:00:13.374 AM
    Server:
    ISE-TDS
    Authentication Method:
    dot1x
    EAP Authentication Method :
    EAP-TLS
    EAP Tunnel Method :
    Username:
    [email protected]
    RADIUS Username :
    host/LENOVO-PC.tdsouth.com
    Calling Station ID:
    00:26:82:F1:E6:32
    Framed IP Address:
    Use Case:
    Network Device:
    WLC
    Network Device Groups:
    Device Type#All Device Types,Location#All Locations
    NAS IP Address:
    192.168.1.225
    NAS Identifier:
    WLC-TDS
    NAS Port:
    4
    NAS Port ID:
    NAS Port Type:
    Wireless - IEEE 802.11
    Allowed Protocol:
    TDS-PEAP-TLS
    Service Type:
    Framed
    Identity Store:
    AD1
    Authorization Profiles:
    Active Directory Domain:
    tdsouth.com
    Identity Group:
    Allowed Protocol Selection Matched Rule:
    TDS-WLAN-DOT1X-EAP-TLS
    Identity Policy Matched Rule:
    Default
    Selected Identity Stores:
    Authorization Policy Matched Rule:
    SGA Security Group:
    AAA Session ID:
    ISE-TDS/215430381/40
    Audit Session ID:
    c0a801e10000007f54ffe828
    Tunnel Details:
    Cisco-AVPairs:
    audit-session-id=c0a801e10000007f54ffe828
    Other Attributes:
    ConfigVersionId=7,Device Port=32768,DestinationPort=1812,RadiusPacketType=AccessRequest,Protocol=Radius,Framed-MTU=1300,State=37CPMSessionID=c0a801e10000007f54ffe828;30SessionID=ISE-TDS/215430381/40;,Airespace-Wlan-Id=1,CPMSessionID=c0a801e10000007f54ffe828,EndPointMACAddress=00-26-82-F1-E6-32,GroupsOrAttributesProcessFailure=true,Device Type=Device Type#All Device Types,Location=Location#All Locations,Device IP Address=192.168.1.225,Called-Station-ID=e0-d1-73-28-a7-70:TDS-Corp
    Posture Status:
    EPS Status:
     Steps
    11001  Received RADIUS Access-Request
    11017  RADIUS created a new session
    Evaluating Service Selection Policy
    15048  Queried PIP
    15048  Queried PIP
    15048  Queried PIP
    15048  Queried PIP
    15004  Matched rule
    11507  Extracted EAP-Response/Identity
    12500  Prepared EAP-Request proposing EAP-TLS with challenge
    11006  Returned RADIUS Access-Challenge
    11001  Received RADIUS Access-Request
    11018  RADIUS is re-using an existing session
    12502  Extracted EAP-Response containing EAP-TLS challenge-response and accepting EAP-TLS as negotiated
    12800  Extracted first TLS record; TLS handshake started
    12805  Extracted TLS ClientHello message
    12806  Prepared TLS ServerHello message
    12807  Prepared TLS Certificate message
    12809  Prepared TLS CertificateRequest message
    12505  Prepared EAP-Request with another EAP-TLS challenge
    11006  Returned RADIUS Access-Challenge
    11001  Received RADIUS Access-Request
    11018  RADIUS is re-using an existing session
    12504  Extracted EAP-Response containing EAP-TLS challenge-response
    12505  Prepared EAP-Request with another EAP-TLS challenge
    11006  Returned RADIUS Access-Challenge
    11001  Received RADIUS Access-Request
    11018  RADIUS is re-using an existing session
    12504  Extracted EAP-Response containing EAP-TLS challenge-response
    12505  Prepared EAP-Request with another EAP-TLS challenge
    11006  Returned RADIUS Access-Challenge
    11001  Received RADIUS Access-Request
    11018  RADIUS is re-using an existing session
    12504  Extracted EAP-Response containing EAP-TLS challenge-response
    12505  Prepared EAP-Request with another EAP-TLS challenge
    11006  Returned RADIUS Access-Challenge
    11001  Received RADIUS Access-Request
    11018  RADIUS is re-using an existing session
    12504  Extracted EAP-Response containing EAP-TLS challenge-response
    12571  ISE will continue to CRL verification if it is configured for specific CA
    12571  ISE will continue to CRL verification if it is configured for specific CA
    12811  Extracted TLS Certificate message containing client certificate
    12812  Extracted TLS ClientKeyExchange message
    12813  Extracted TLS CertificateVerify message
    12804  Extracted TLS Finished message
    12801  Prepared TLS ChangeCipherSpec message
    12802  Prepared TLS Finished message
    12816  TLS handshake succeeded
    12509  EAP-TLS full handshake finished successfully
    12505  Prepared EAP-Request with another EAP-TLS challenge
    11006  Returned RADIUS Access-Challenge
    11001  Received RADIUS Access-Request
    11018  RADIUS is re-using an existing session
    12504  Extracted EAP-Response containing EAP-TLS challenge-response
    Evaluating Identity Policy
    15006  Matched Default Rule
    24433  Looking up machine/host in Active Directory - [email protected]
    24492  Machine authentication against Active Directory has failed
    22059  The advanced option that is configured for process failure is used
    22062  The 'Drop' advanced option is configured in case of a failed authentication request
    But the user can authenticated by EAP-TLS
    AAA Protocol > RADIUS Authentication Detail
    RADIUS Audit Session ID : 
    c0a801e10000007f54ffe828
    AAA session ID : 
    ISE-TDS/215430381/59
    Date : 
    March     11,2015
    Generated on March 11, 2015 2:48:43 PM ICT
    Actions
    Troubleshoot Authentication 
    View Diagnostic MessagesAudit Network Device Configuration 
    View Network Device Configuration 
    View Server Configuration Changes
    Authentication Summary
    Logged At:
    March 11,2015 7:27:32.475 AM
    RADIUS Status:
    Authentication succeeded
    NAS Failure:
    Username:
    [email protected]
    MAC/IP Address:
    00:26:82:F1:E6:32
    Network Device:
    WLC : 192.168.1.225 :  
    Allowed Protocol:
    TDS-PEAP-TLS
    Identity Store:
    AD1
    Authorization Profiles:
    TDS-WLAN-PERMIT-ALL
    SGA Security Group:
    Authentication Protocol :
    EAP-TLS
     Authentication Result
    [email protected]
     State=ReauthSession:c0a801e10000007f54ffe828
     Class=CACS:c0a801e10000007f54ffe828:ISE-TDS/215430381/59
     Termination-Action=RADIUS-Request
     cisco-av-pair=ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-PERMIT_ALL_TRAFFIC-508adc03
     MS-MPPE-Send-Key=5a:9a:ca:b0:0b:2a:fe:7d:fc:2f:8f:d8:96:25:50:bb:c8:7d:91:ba:4c:09:63:57:3e:6e:4e:93:5d:5c:b0:5d
     MS-MPPE-Recv-Key=24:fa:8d:c3:65:94:d8:29:77:aa:71:93:05:1b:0f:a5:58:f8:a2:9c:d0:0e:80:2d:b6:12:ae:c3:8c:46:22:48
     Airespace-Wlan-Id=1
     Related Events
     Authentication Details
    Logged At:
    March 11,2015 7:27:32.475 AM
    Occurred At:
    March 11,2015 7:27:32.474 AM
    Server:
    ISE-TDS
    Authentication Method:
    dot1x
    EAP Authentication Method :
    EAP-TLS
    EAP Tunnel Method :
    Username:
    [email protected]
    RADIUS Username :
    [email protected]
    Calling Station ID:
    00:26:82:F1:E6:32
    Framed IP Address:
    Use Case:
    Network Device:
    WLC
    Network Device Groups:
    Device Type#All Device Types,Location#All Locations
    NAS IP Address:
    192.168.1.225
    NAS Identifier:
    WLC-TDS
    NAS Port:
    4
    NAS Port ID:
    NAS Port Type:
    Wireless - IEEE 802.11
    Allowed Protocol:

    Hello,
    I am analyzing your question and seeing the ISE logs i can see that the machine credentials was LENOVO-PC. Do you have shure that these credentials has in your Active Directory to validate this machine ? The machine certificate has the correct machine credentials from the domain ? The group mapped in the ISE rule has the machine inside this group ?
    Differently from the user authentication that happens with success because the domain credentials can be validate from the Active Directory and get access to the network.

  • ISE - AAA radius authentication for NAD access

    Hi ,
    I have configured the switches to use the ISE as the Radius server to authenticate with , on the ISE i've configured an authentication policy
    for the "NADs" using the "Wired Devices" group which points to the AD indentity source to authenticate against .
    While testing the login access to the switches we've come up with 2 results :
    1.A domain user can indeed login to the switch as intended.
    2.Every domain user which exists in the AD indentity source can login , this is an undesired result .
    So I am trying to search for a way to restrict access to the NADs to only a particular group belonging to the AD , for example the group/ou
    of the IT_department only .
    I haven't been successfull , would appreciate any ideas on how to accomplish this .
    Switch configurations :
    =================
    aaa new-model
    aaa authentication login default group radius local
    ISE Authentication policy
    ==================
    Policy Name : NADs Authentication
    Condition:  "DEVICE:Device Type Equals :All Device Types#Wired"
    Allowed Protocol : Default Network Access
    use identity source : AD1

    Thank you for the quick replys , and now  ok , I've configured the following authorization policy :
    Rule Name : Nad Auth
    Conditions
    if: Any
    AND : AD1:ExternalGroups EQUALS IT_Departments
    Permissions , then PermitAccess
    What I don't understand is that it needs to match an "identity group" which can be either "Endpoint Identity group" or "Users Identity group" , I am limited with the if statement and cannot chose the same device group a choose before .
    How can i do that , i am thinking ahead an asking myself if in other cases a user might match this policy rule and can interfer ?

  • Cisco ISE (Authentication failed: 24415 User authentication against Active Directory failed since user's account is locked out)

    Hi,
    I have a setup ISE 1.1.1. Users are getting authenticate against AD. Everything is working fine except some users report disconnection. I see in the ISE that (Authentication failed: 24415 User authentication against Active Directory failed since user's account is locked out). Users are using Windows 7 OS.
    Error is enclosed & here is the port configuration.
    Port Configuration.
    interface GigabitEthernet0/2
    switchport access vlan 120
    switchport mode access
    switchport voice vlan 121
    authentication event fail action next-method
    authentication event server dead action reinitialize vlan 120
    authentication event server alive action reinitialize
    authentication host-mode multi-auth
    authentication order mab dot1x
    authentication priority dot1x mab
    authentication port-control auto
    authentication periodic
    authentication timer reauthenticate server
    mab
    dot1x pae authenticator
    dot1x timeout tx-period 60
    spanning-tree portfast
    ip dhcp snooping limit rate 30 interface GigabitEthernet0/2
    switchport access vlan 120
    switchport mode access
    switchport voice vlan 121
    authentication event fail action next-method
    authentication event server dead action reinitialize vlan 120
    authentication event server alive action reinitialize
    authentication host-mode multi-auth
    authentication order mab dot1x
    authentication priority dot1x mab
    authentication port-control auto
    authentication periodic
    authentication timer reauthenticate server
    mab
    dot1x pae authenticator
    dot1x timeout tx-period 60
    spanning-tree portfast
    ip dhcp snooping limit rate 30
    Please help.

    The error message means that Active Directory server Reject the authentication attempt
    as for some reasons the user account got locked.I guess, You should ask your AD Team to check in the AD
    Event Logs why did the user account got locked.
    Under Even Viewers, You can find it out
    Regards
    Minakshi (Do rate the helpful posts)

  • Problem to get Web admin access on cisco ISE

    Hi,
    We are currently having problems to access via Web admin UI to cisco ISE. after we put the password, we get this message on screen:
    authentication failed due to zero RBAC group.
    The ISE version that we are using is: 1.1.2.145 path 3
    Do you have any idea about that?
    Thank you for your attention on this matter.
    Regards.

    In Cisco ISE, RBAC policies are simple access  control policies that use RBAC concepts to manage admin access. These  RBAC policies are formulated to grant permissions to a set of  administrators that belong to one or more admin group(s) that restrict  or enable access to perform various administrative functions using the  user interface menus and admin group data elements. I think there is problem with your RBAC policy configuration. Please follow the below link for help.
    http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_man_identities.html#wp1282656
    http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_man_identities.html#wp1283009

  • User authentication against LDAP - Non-AD

    Hi,
    We are trying to setup LDAP authentication against an LDAP, Oracle Unified Directory and below are the parameters of ldap.properties file:
    ldapAuthentication.defaultRole = ROLE_AUTHENTICATED_PRINCIPAL
    ldapAuthentication.enabled = true
    ldapAuthentication.tryNextProviderIfNoAuthenticated = true
    ldapAuthentication.stopIfCommunicationError = true
    ldapAuthentication.url=ldap\://localhost:389/
    ldapAuthentication.rootContext=DC=test,DC=com
    ldapAuthentication.securityPrincipal=CN=Directory Manager
    ldapAuthentication.securityCredential.encrypted=password
    ldapAuthentication.keepContextPrefix=false
    ldapAuthentication.isAD=false
    ldapAuthentication.userAccountSearchKey=CN
    ldapAuthentication.firstNameSearchKey=givenName
    ldapAuthentication.lastNameSearchKey=sn
    Still I am getting while I try to login to OIA as an OUD user:
    WARN [UserManagerImpl] RbacxUser with username: 'cn=oiaadmin' not found
    Please help

    Hi Jcorker,
    According to your description, you need to access the SQL Serve Analysis Services database which is configured as cluster for SQL & SSAS from another domain, right?
    In SSAS we can use the solution below achieve the requirement.
    1.Create new domain account and impersonate the web site with that.
    2.Create local user account on the analysis service with same exact username/password as like domain account created in the previous step.
    However, you cannot create a local account with the same name on both servers. I have tested it on my local environemnt, we can create the same local account with the same name on both servers. In your scenario, if DB1 and DB2 on different server, you can
    create a local account with the same name on both servers. Please post the detail errors, so that we can make further analysis.
    Besides, SSAS only allows users of the same domain or trusted domains and it does not allow users from any domain except from these two. You can configure the trust relationship between the domains.
    http://technet.microsoft.com/en-us/library/cc961481.aspx
    Regards,
    Charlie Liao
    If you have any feedback on our support, please click
    here.
    Charlie Liao
    TechNet Community Support

  • ASA Remote Access Authentication with LDAP Server

    Thank you in advance for your help.
    I am configuring an ASA to authenticate with a ldap server for ipsec vpn access.  My customer has 3 networks that are to be accessed by remote users.  However they want to be able to say that one user can get to 2 of the networks and not the 3rd.  So basically they want control over what network behind the firewall each user can access.  This seems doable from my reading and I had planned to creating a group for each network that needs accessible and either do attribute maps to each group with a separate group created on the ldap server for authentication.  Basically a ldap group on the ldap server that will have the users name in the group in order for access.  I can restrict access via acl's or filtering to force my group to only be allowed access to a specific network.  Here is the problem I am having now.
    The ldap server has been created and seems to be working fine.  I have created my AAA groups and servers and I have done the ldap test with a test user vpntest and a password on the ldap server.  When I run the authentication test from the ADSM or command line I get a good authentication successful message.  So I configured a vpn client remotely and attempted to authenticate to this group and it says there is no user by that name.  Below is a paste of the debug.  The second part is when I did a successful test from the ASDM or CLI and it worked great.  The first part is when I attempted from the vpn client.  It all looks the same from the search criteria.  What am I missing here or does anyone more knowledgeable see anything that I am doing wrong.  Can this be done this way or should I try radius.  The customer was just adament about using ldap.
    extvpnasa5510#
    [243] Session Start
    [243] New request Session, context 0xd5713fe0, reqType = 1
    [243] Fiber started
    [243] Creating LDAP context with uri=ldaps://130.18.22.44:636
    [243] Connect to LDAP server: ldaps://130.18.22.44:636, status = Successful
    [243] supportedLDAPVersion: value = 2
    [243] supportedLDAPVersion: value = 3
    [243] No Login DN configured for server 130.18.22.44
    [243] Binding as administrator
    [243] Performing Simple authentication for  to 130.18.22.44
    [243] LDAP Search:
            Base DN = [ou=employees,o=msues]
            Filter  = [uid=vpntest]
            Scope   = [SUBTREE]
    [243] User DN = [uid=vpntest,ou=employees,o=msues]
    [243] Talking to iPlanet server 130.18.22.44
    [243] No results returned for iPlanet global password policy
    [243] Fiber exit Tx=386 bytes Rx=414 bytes, status=-1
    [243] Session End
    extvpnasa5510#
    [244] Session Start
    [244] New request Session, context 0xd5713fe0, reqType = 1
    [244] Fiber started
    [244] Creating LDAP context with uri=ldaps://130.18.22.44:636
    [244] Connect to LDAP server: ldaps://130.18.22.44:636, status = Successful
    [244] supportedLDAPVersion: value = 2
    [244] supportedLDAPVersion: value = 3
    [244] No Login DN configured for server 130.18.22.44
    [244] Binding as administrator
    [244] Performing Simple authentication for  to 130.18.22.44
    [244] LDAP Search:
            Base DN = [ou=employees,o=msues]
            Filter  = [uid=vpntest]
            Scope   = [SUBTREE]
    [244] User DN = [uid=vpntest,ou=employees,o=msues]
    [244] Talking to iPlanet server 130.18.22.44
    [244] Binding as user
    [244] Performing Simple authentication for vpntest to 130.18.22.44
    [244] Processing LDAP response for user vpntest
    [244] Authentication successful for vpntest to 130.18.22.44
    [244] Retrieved User Attributes:
    [244]   sn: value = test user
    [244]   givenName: value = vpn
    [244]   uid: value = vpntest
    [244]   cn: value = vpn test user
    [244]   objectClass: value = top
    [244]   objectClass: value = person
    [244]   objectClass: value = organizationalPerson
    [244]   objectClass: value = inetOrgPerson
    [244] Fiber exit Tx=284 bytes Rx=414 bytes, status=1
    [244] Session End

    Hi Larry,
    You can map AD group memberships to specific group policies on the ASA, you can find that configuration here:
    - http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/91831-mappingsvctovpn.html
    Let me know if further assistance is required!
    Please proceed to rate and mark as correct the helpful Post!
    David Castro,
    Regards,

Maybe you are looking for