ASA WebVPN - restrict access to users in an AD group via ACS

Hi folks.
I'm doing an WebVPN pilot on one of our ASA's (running 7.2.2). Everything is working fine, but I've been asked to restrict access to users that are members of a certain Active Directory group (lets call the group "VPNTEST")
Right now the ASA does radius auth against out ACS 4.x appliance, which has an external database mapping (via the ACS remote agent) to our Windows active directory domain.
Currently there are only two groups in ACS, the Default (which we use for Wireless authentication) and the "Operations" group, which we use for TACACS auth for the network.
I can create a group in ACS that maps to the AD VPNTEST group, but where/how do I restrict WebVPN access to just members of that group? Is it a setting on the ACS or the ASA?

Try using the following to tie users to certain group policies:
Using a RADIUS Server
Using a RADIUS server to authenticate users, assign users to group policies by following these steps:
Step 1 Authenticate the user with RADIUS and use the Class attribute to assign that user to a particular group
policy.
Step 2 Set the class attribute to the group policy name in the format OU=group_name
For example, to set a WebVPN user to the SSL_VPN group, set the RADIUS Class Attribute to a value
of OU=SSL_VPN; (Do not omit the semicolon.)

Similar Messages

  • ASA WebVPN. How do you restrict access to users in an AD group using LDAP?

    Hi All,
    I am trying to configure separate WebVPN connection profiles to give different portal bookmark contents to users based on their AD group membership.  This has been very difficult, even though I beleive it should be easy.
    The login page of teh ASA by default has a dropdown to allow default users to access the default portal and the SSL VPN client connection.
    There are two other portals that I would like to restrict access to based on AD group membership.  I have set these up to be selected by URL.
    The biggest problem is, I have no way of knowing how to go about this.  The AAA LDAP options show a group membership search, which I have configured, but I cannot say "Profile X is restricted to AD group CarpetBaggers", so that if soneone that is NOT a carpetbagger tries to log in, it fails.
    I can only do an all or nothing scenario.
    It would be nice to use Dynamic Access Policies to do this, and I have created a few, but they do NOT seem to work when the drop down aliases or URLs are in use.  So how do I go about using them in this scenario?  Turning off the aliases or URLs is not really an option right now.
    Scenario 1 would work the best for me.  Restrict access to profiles/groups based on AD group membership using LDAP.
    Scenario 2 would be an ideal longer term solution.
    Any thoughts, ideas or assitance would be greatly appreciated.
    Cheers

    This is exactly what i was looking for, and Nelson is correct.  When you enter the DAP configuration for a profile click on "Advanced" and there is the option to create a logical expression.  The guide (ther is a button to access this) is really helpful, with a couple of examples.  This is what i used:
    assert(function()
       if ( (type(aaa.ldap.distinguishedName) == "string") and
            (string.find(aaa.ldap.distinguishedName, "OU=Users") ~= nil) )
    then
           return true
       end
       return false
    end)()
    from the debug dap you can see what Users relates to;
    DAP_TRACE: Username: MyUsername, aaa.ldap.distinguishedName = CN=Mr B,OU=Users,OU=Site ******,DC=CH,DC=Mycompany,DC=com
    My admin account fails to get me in to the same profile:
    DAP_TRACE: dap_add_to_lua_tree:aaa["ldap"]["distinguishedName"]="CN=Admin Mr B,OU=Admin Users,OU=Site *****,DC=CH,DC=Mycompany,DC=com"
    Thanks
    Andrew

  • Restrict access to users in customer line item display FBL5N

    Hi all,
    We got a requirement from my client that, they want to restrict access of their users to view details of few customers  only. The user has a right to view FBL5N transaction code, but he cannot view all customers details.
    we created 4 customer account groups,we created like .. SD customers1
                                 SD customers2
                                 Onetime customers
                                 FI customers
    These FI customers cannot be viewed by all users except who has authorization in Tcode  FBL5N, we need to restrict to display only SD and one time customers details.
    we have tried with Basis but its not working and its blocking to view all customers.
    anyone got this kind of requirement , Is it possible to restrict....please help me.
    Thanks
    Nagesh
    Edited by: nag on Dec 27, 2011 5:26 PM

    It is standard behaviour that the authorization object F_KNA1_GRP(account group authroization) is not checked
    in the transacion FBL5N. You can confirm this functionality in trans. SE24.
    As a workaround, I would suggest you to use the authorization object F_KNA1_BED Customer: Account Authorization
    If you assign an authorization group as the accouting group, perhaps you can get a similar functionality.
    Please note that for the 'drill-down' or direct call of FBL5N these objects are checked:
      F_BKPF_BLA Accounting Document: Authorization for Document Types
      F_BKPF_BUK Accounting Document: Authorization for Company Codes
      F_BKPF_GSB Accounting Document: Authorization for Business Areas
      F_BKPF_KOA Accounting Document: Authorization for Account Types
      F_BKPF_BED Accounting Document: Account Authorization for Customers
      F_KNA1_BED Customer: Account Authorization
      F_KNA1_BUK Customer: Authorization for Company Codes
    Kind Regards
    Soumya

  • Best way to restrict access to documents (outside of the group or library level)

    Hi, we're thinking of implementing SharePoint Server 2013 Standard Edition for our organization. Many of our employees are research scientists working on proprietary information. From the (admittedly little) I understand about SharePoint, if a user wants
    to restrict access to a particular document to the 2 or 3 people with whom they're collaborating (and also have it not appear in the search results), they will have to email their power user to request that a new document library be created in which they can
    store their documents. Is that correct? In this case, what is the best way to handle item-level permissions? Users absolutely want to have the freedom to restrict access to their documents themselves rather than being forced to go to their power user. Thanks.

    Hi,
    Per my knowledge, if you want to restrict access to the documents to some users, then you need to have Manage Permissions permission to modify other users’ permission on the documents.
    If you do not have the Manage Permissions permission, I recommend to ask the site administrator to create a workflow as below to remove the corresponding users’ permission on the documents which you uploaded. You can start the workflow on the document you
    upload and then the permission of the users set on the workflow will be removed from the document.
    Best regards.
    Thanks
    Victoria Xia
    TechNet Community Support

  • Restricted access for user in SU01

    Hi All
    How can we give authorisation to a User to modify access (Create/Delete/Password Change/Role assign /Role Delete..etc) for other user IDs but that user should have only display access for his User ID.
    Please Help me in this.

    Hi,
    I have worked with many clients, and the requirement of handling the user Administration and Role Administration is different from each client to other client.
    Some client may ask for the same person should handle both User and Role ADministration, but some client may ask for separating the tasks.
    In your case, if you want to restric the person to maintain the other users but not the own user id, this can be achieved by doing the following:
    Create a separate user group who is doing the administration part and create other user groups for other users.
    Create a role with SU01 and restrict the Standard objects with all user groups except the administation one and add S_USER_GRP authorization object manually into the same role and provide only 03 with the administration object.
    The above will solve the problem of administration not able to update the own user id, but the other users.
    Regards
    Anandm

  • How do I restrict access so users can only visit certain sites?

    At work we are setting up a laptop in order to do only one thing - use one particular website. I'd like to make sure nobody can visit any other sites.

    Your secure computer has a piece of unpleasant software - My Web Search. Remove any signs of it in Add-ons>Extensions and Plug-ins. Also check in Add/Remove Programs(Programs and Features in Win7). Also make sure you don't have any entries for Fun Web Products.
    You are showing Fx3.5.8. If that is so, it is high time you updated. Chances are, though, that My Web Search has frozen your User Agent String.
    Google for further information but don't accept advice from people behind these products. You can also look in the Search Firefox Help box above.

  • Access denied errors in domain logs after configuring Ldap and restricting access to users

    Hi Experts,
    I'm getting access denied errors in my domain logs , this log is written continiously ..Has any one encountered the same issue and fixed this?
    ####<Sep 2, 2014 2:30:07 PM EDT> <Error> <Default> <ftizsldmwapp001.ftdc.cummins.com> <AdminServer> <[ACTIVE] ExecuteThread: '27' for queue: 'weblogic.kernel.Default (self-tuning)'> <<anonymous>> <> <096a131bdb6c126e:6cecae89:14834848020:-8000-0000000000009bc8> <1409682607304> <J2EE JMX-46335> <MBean attribute access denied.
      MBean: EMDomain:EMTargetType=j2ee_application,name=em,type=EMIntegration,Application=em
      Getter for attribute HostName
      Detail: Access denied. Required roles: Admin, Operator, Monitor, executing subject: principals=[]
    TIA,
    -Karthik

    Hi Experts,
    I'm getting access denied errors in my domain logs , this log is written continiously ..Has any one encountered the same issue and fixed this?
    ####<Sep 2, 2014 2:30:07 PM EDT> <Error> <Default> <ftizsldmwapp001.ftdc.cummins.com> <AdminServer> <[ACTIVE] ExecuteThread: '27' for queue: 'weblogic.kernel.Default (self-tuning)'> <<anonymous>> <> <096a131bdb6c126e:6cecae89:14834848020:-8000-0000000000009bc8> <1409682607304> <J2EE JMX-46335> <MBean attribute access denied.
      MBean: EMDomain:EMTargetType=j2ee_application,name=em,type=EMIntegration,Application=em
      Getter for attribute HostName
      Detail: Access denied. Required roles: Admin, Operator, Monitor, executing subject: principals=[]
    TIA,
    -Karthik

  • SQ00 Restrict Access By User Group

    Hi all,
    I've just created a BOM Overview Report (Query) in SQ00 by using a logical database. I've assigned user's to the User group for the Z_BOM info set to run the report.   
    In Production client nobody has permissions to run SQ00 at this time. My question is if I put transaction SQ00 or SQ01 in a role and assign to users will they be able to run for any info set, or try and create new queries on thier own in there?   I don't want my production floor folks being able to see financial queries.....how do I set this up from a security standpoint...so these users only see the new SQ00 BOM Overview Report?  Thanks for your Input!!

    Let me tell you a better way of doing this for all users...
    Steps:
    1. Remove authorizations for tcodes SQ00, SQ01, SQ03, SQVI.
    2. If possible remove authorization for SA38, SE38. This is to prevent users by copying the program name from other queries (menu >> system >> status) and executing.
    3. Note down the report name for a particular query. In SQ01 you can do this by clicking In background button or following the menu path Query >> More functions >> Display Report name
    4. Create a custom authorization object e.g. Y_SHOP_FLOOR in tcode SU21 (similarly for financials etc if you want) and assign it to relevant users.
    4. Create a Z or Y transaction code in SE93 (of type report), assign the step 4 custom authorization object to this tcode and enter the report name from step 3.
    Edited by: Jeevan Sagar on Feb 5, 2012 1:18 AM

  • How do I restrict access to the RT Series PXI Controller via its FTP server?

    The RT Series PXI Controllers run an FTP server, so I can view files on the controller over the Internet wtih a Web browser. I can also download and upload files with a Web browser. How can I instruct the FTP server to give access only to specified, trustworthy FTP clients?

    It is possible to "Lock" the controller from the Measurement and Automation Explorer program. The password you set when locking the controller (which prevents others from making configuration changes to the controller while running) is the same password that controls access to the FTP server. When the controller is unlocked, anyone who can access the PXI controller's IP can read, write, and delete files on the FTP server. When locked, anyone can read data from the FTP server, but only when logged in with the lock password will you have access to write or delete data.
    For more information on locking your controller, see the user manual, MAX online help, or the following link.
    NI Developer Zone: Controlling Access to LabVIEW Real-Time PXI Targets

  • Restrict Access to certain users based on if a variable in the SQL database is set to 1

    Hey guys,
    I am quite new to PHP and MySQL and I have a question concerning access  restriction. For a website project I am experimenting with Dreamweaver's  login and restrict access behavior, which works fine. However, on the  website I would like to restrict access for users that only have a 1 set  in the corresponding MySQL database (which means that e.g. each page has a different variable in the database that can be set to 1, which would allow me to personify access beyond the level of the out-of-the box option, where each user can only have one access level). So it is quite similiar to the  out-of-the-box restrict access to page based on user group, but just  depending on another variable in the database.
    I guess it can be done with an if condition that checks in the database if the logged in user has a 1 in this variable, and if yes give her/him access if not redirect to another page. However, I could not figure out  how to implement that.
    Your help is highly appreciated!
    Thanks in advance!

    Hello guys,
    I spend quite some time on the internet reseaching my wish and redefined my need: I would basically like to have the possibility to assign a user multiple access levels. There would be e.g. 10 pages for each I create an access level. Then a user with e.g. access to pages 2 and 8 can only access these two pages. So my basic question is if and if yes how I can assign a user muliple access levels at a time and store these values in the MySQL database.
    Thanks a lot for your help!!

  • OIM 11g R1 (11.1.1.5.0) Restricting access to Modify resources by field.

    Is there a way to restrict the access to modify specific fields on a resource, based on roles? In design console you have the options of, "Allow Insert", "Allow Update", "Allow Delete" on the form associated with different roles. Is there any way you can restrict this access specifically to fields in the way you can restrict access to user attributes based on authorization policies?

    You are failing to utilize the product then.  You don't have to utilize a soa-composite for this.  They can be set to auto-approve anyway.  But you should not just grant admin access to the user and all their resources so easily.
    Not sure what kind of event handler you can even use.  You could try and explicitly deny access to those roles by adding them to the form permissions and unchecking all the values.
    -Kevin

  • Restricting access to Queries via Search

    Does anyone have any ideas on restricting access to queries from the Bex search. We have folks that are using the search functionality of Bex and are finding queries that we have not been published to a reporting role. We instruct our query writers that when devloping queries, do not publish them to a reporting role until they are finalized and tested. We are finding that folks are using search in Bex and finding these queries that may be in the middle of development and trying ot use them. In other words, we would like to restrict the Bex search to just queries published to reporting roles.

    Hi Diago,
         Our dilema is that restricting access of the search by query name (via the role) requires the query writer, when finished with the development of their query, to do a savas with a different technical name that falls into the role restrictions of the authorization. This then leaves two versions of the query out there until the original gets deleted, if the query writer happens to remember to do that. It would be great to limit the search mechanism to just published queries. What are other folks doing to get around this issue. It seems that everyone would be running into it unless the search could be restricted in such a manner.

  • Restricting access of site collection admin

    I have a group of three people in the site collection administrators group.  How do I restrict access to certain content from this group?  These are technology people and we have confidential finance and HR material that they are not authorized to see.  It seems no matter what the security is set at, these people can still see the content.  Please help.

    Hi Milissa,
    An old post, however for reference of anyone finding it, this can now be solved in SharePoint 2010 and SharePoint 2013.
    There is a security module that blocks site collection administrators from viewing sensitive content. More information is available here: https://www.berkeleyit.com/enterprise-security-services-platform-for-sharepoint/
    [At the time of writing] The second video on the right shows this functionality.
    Hope this helps,
    Scott

  • HT201304 Is it possible to restrict access to specific IOS apps based on the WIFI profile that a user has connected to?

    Is it possible to restrict access to specific IOS apps based on the WIFI profile that a user has connected to?

    you might be able to block it if the app uses Internet access
    and depending on your wireless you might be able to block a specific user
    accessing the backend host that the app uses
    some firewalls offer application filtering but I'm not aware of any that work with ios apps

  • How to restrict access to views for some users in the app?

    Hi SDN!
    I have an WD application wich embedded in the portal. Appication has 2 iViews (and 2  pages respectively). These iViews consist several views connected with each other (e.g. one view provide list data, second view is add/edit form for this data). I need to restrict access for some users for view with add/edit form. I can't make separate page for this view.
    What I've done:
    1) create yet another UIContainer for this view in main window and embed view to this container. It was be done for create separate iView for form.
    2) in the portal I create iView for this form but don't embedd in any page.
    When I try to call my form from list data (that is one iView from another) I get exception:
    <b>com.sap.tc.webdynpro.services.exceptions.WDRuntimeException: duplicate usage of view .MyCarRentalAddCity</b>
    Is there a way to get needed functional?
    Thanks,
    Lev

    Hi,
    do you need to remove the IView from the portal menu or do you just want to make a View container in your WD application invisible if the user doesn't have the rights to see it.
    If so, you could create your own roles on the app server:
    You need to create a new class that extends NamePermission like:
    import com.sap.security.api.permissions.NamePermission;
    public class ApplicationAccessPermission extends NamePermission {
               * @param name
              public ApplicationAccessPermission(String name) {
                   super(name);
               * @param name
               * @param action
              public ApplicationAccessPermission(String name, String action) {
                   super(name, action);
    Also, you have to create an Action.XML file that looks like this:
    <BUSINESSSERVICE
         NAME="com.vendor.administration">
         <DESCRIPTION
              LOCALE="en"
              VALUE="actions view usage"/>
         <ACTION
              NAME="View Permission">
              <DESCRIPTION
                   LOCALE="en"
                   VALUE="Show view"
                   />
              <PERMISSION
                   CLASS="com.vendor.utilities.ApplicationAccessPermission"
                   NAME="ShowView"
                   />
         </ACTION>
    </BUSINESSSERVICE>
    If you have created these to files in your packages, you can access this function like:
    IUser user ;
    try {
              user = WDClientUser.getCurrentUser().getSAPUser();
              if(user.hasPermission(new ApplicationAccessPermission("Show view"))){
                   wdContext.currentV_UIElement().setViewVisibility(WDVisibility.VISIBLE);
              }else{
                   wdContext.currentV_UIElement().setViewVisibility(WDVisibility.NONE);
         }catch (WDUMException e1) {
              wdContext.currentV_UIElement().setViewVisibility(WDVisibility.NONE);
                    e1.printStacktrace();
    You have to bind the ViewVisibility attribute of the context to the View Container you want to hide.
    The applicationAccessPermission you defined in the XML File will be visible in the UME Manager of you J2EE engine. With this action you can create a new role and group that you can map to the users that should see you view.
    But, the exception you get is because you have embedded one view twice, which is not possible.
    Hope this helps.
    Regards,
    Dennis

Maybe you are looking for