WLC 5508 LDAP Windows 2008 Server - auth based on AD groups

Question

hi NG,
i'm trying to web-authenticate my Wifi user of an WLC 5508 against LDAP.
Thereby i'm trying to autenticate all users within a GROUP, not an OU within the MS Active Directory based upon an Windows 2008 Server.
I can authenticate against a user, witch is beeing put into an OU, according to examples based here: https://www.cisco.com/en/US/products/ps6366/prod_configuration_examples_list.html
Checking based upon Users within OUs works fine.
But i have not got all of those users wihin one single OU!
Need help for following:    LDAP-Auth based on AD Groups:
Using:
MS-Domain:                          MY-DOMAIN.CH
AD-GROUP:                          VPN-USERS
AD-Structure:
MY-DOMAIN.CH
|
GROUPS
        |
    Administrative Groups
                      |
                 VPN-USERS
                          (-> Member of this Groups (Wireless1, Wirless2, ...)
Server Adress:               IP.IP.IP.IP
Port:                                 389
Enable Server Stats      YES
Simple Bind                    Authenticated
Bind Username              LDAP-USER
Bind Password               supersecret
Bind Passw. confirm      supersecret
User Base DN:               ?-1-?
User Attribute:                ?-2-?
User Object Type:          Person
Server Timeout               2
What happens for instance, if i put a GROUP within a GROUP regarding the LDAP Authentication.
I guess i have to authenticate against the "upper" GROUP, or do i have to create an entry on the WLC for every GROUP i'm questoning?
Could some one provide my with an example, since i have not found documentation regarding this topic.
Thank you.

Answer 1

Hi,
User Base DN : this is in case you want to restrict the search area. If you put "dc=mydomain,dc=CH", you will search your whole AD. Depending on the size, it can be slow ...
Remember that the User Base DN is also used for the admin user.
In conclusion, User Base DN should be the most restrictive path that leads to both the admins and the users you want to authenticate.
Example :
OU=Employees,OU=Humans,DC=Mydomain,DC=CH
This would prevent to search in machines or any assets. This implies that the admin you bind with is an employee and you are only authenticating employees. You can have any number of OUs under employees, it doesn't matter
Attribute : This is the object attribute that the WLC uses to compare with the user name. In general, you would go with sAMAccountName in AD. CN would be another common example for LDAP databases.
If what you are looking for is to restrict access and only authenticate people who belong to a certain group. Then you need a radius server like ACS.
That server will be able to make selections and check the "memberOf" attribute to make sure it is in a certain group.
Nicolas
===
Don't forget to rate answers that you find useful