The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Lightweight Directory Access Protocol (LDAP) is integrated into Cisco software as an authentication, authorization, and accounting (AAA) protocol alongside the existing AAA protocols such as RADIUS, TACACS+, Kerberos, and Diameter. The AAA framework provides tools and mechanisms such as method lists, server groups, and generic attribute lists that enable an abstract and uniform interface to AAA clients irrespective of the actual protocol used for communication with the AAA server. LDAP supports authentication and authorization functions for AAA.
Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
If you are using a secure Transport Layer Security (TLS) secure connection, you must configure X.509 certificates.
Transport Layer Security (TLS) is an application-level protocol that enables secure transactions of data through privacy, authentication, and data integrity. It relies upon certificates, public keys, and private keys for clients to prove the identity. Certificates are issued by Certificate Authorities (CAs). Each certificate includes the name of the authority that issued it, the name of the entity to which the certificate was issued, the entity’s public key, and time stamps that indicate the certificate’s expiration date. TLS support for LDAP is mentioned in RFC 2830 as an extension to the LDAP protocol.
The bind operation is used to authenticate a user to the server. It is used to start a connection with the LDAP server. LDAP is a connection-oriented protocol. The client specifies the protocol version and the client authentication information. LDAP supports the following binds:
An authenticated bind is performed when a root distinguished name (DN) and password are available. In the absence of a root DN and password, an anonymous bind is performed. In LDAP deployments, the search operation is performed first and the bind operation later. This is because, if a password attribute is returned as part of the search operation, the password verification can be done locally on an LDAP client. Thus, there is no need to perform an extra bind operation. If a password attribute is not returned, the bind operation can be performed later. Another advantage of performing a search operation first and a bind operation later is that the DN received in the search result can be used as the user DN instead of forming a DN by prefixing the username (cn attribute) with the base DN. All entries stored in an LDAP server have a unique DN. The DN consists of two parts: the Relative Distinguished Name (RDN) and the location within the LDAP server where the record resides.
Most of the entries that you store in an LDAP server will have a name, and the name is frequently stored in the Common Name (cn) attribute. Because every object has a name, most objects you store in an LDAP will use their cn value as the basis for their RDN.
A search operation is used to search the LDAP server. The client specifies the starting point (base DN) of the search, the search scope (either the object, its children, or the subtree rooted at the object), and a search filter.
For authorization requests, the search operation is directly performed without a bind operation. The LDAP server can be configured with certain privileges for the search operation to succeed. This privilege level is established with the bind operation.
An LDAP search operation can return multiple user entries for a specific user. In such cases, the LDAP client returns an appropriate error code to AAA. To avoid these errors, appropriate search filters that help to match a single entry must be configured.
The compare operation is used to replace a bind request with a compare request for an authentication. The compare operation helps to maintain the initial bind parameters for the connection.
Lightweight Directory Access Protocol (LDAP) is a powerful and flexible protocol for communication with AAA servers. LDAP attribute maps provide a method to cross-reference the attributes retrieved from a server to Cisco attributes supported by the security appliances.
When a user authenticates a security appliance, the security appliance, in turn, authenticates to the server and uses the LDAP protocol to retrieve the record for that user. The record consists of LDAP attributes associated with fields displayed on the user interface of the server. Each attribute retrieved includes a value that was entered by the administrator who updates the user records.
The LDAP host is normally a multiuser system running LDAP server software such as Active Directory (Microsoft) and OpenLDAP. Configuring router-to-LDAP server communication can have several components:
1.
enable
2.
configure
terminal
3.
ldap
server
name
4.
ipv4
ipv4-address
5.
transport
port
port-number
6.
timeout
retransmit
seconds
7.
exit
1.
enable
2.
configure
terminal
3.
aaa
4.
ldap
server
name
5.
bind
authenticate
root-dn
password [0 string | 7 string] string
6.
search-filter
user-object-type
string
7.
base-dn
string
8.
mode
secure
[no-negotiation]
9.
secure
cipher
3des-ede-cbc-sha
10.
exit
Configuring the router to use AAA server groups enables you to group existing servers. You need to select a subset of the configured server hosts and use them for a particular service. A server group is used in conjunction with a global server-host list. The server group lists the IP addresses of the selected server hosts. Server groups can also include multiple host entries for the same server, as long as each entry has a unique identifier.
If two different host entries on the same LDAP server are configured for the same service (for example, accounting) the second host entry configured acts as failover backup to the first one. Using this example, if the first host entry fails to provide accounting services, the network access server will try the second host entry configured on the same device for accounting services. (The LDAP host entries will be tried in the order in which they are configured.) To define a server host with a server group name, enter the following commands. The listed server must exist in global configuration mode.
1.
enable
2.
configure
terminal
3.
aaa
new-model
4.
aaa
group
server
ldap
group-name
5.
server
name
6.
exit
1.
enable
2.
configure
terminal
3.
aaa new-model
4.
ldap
server
name
5.
authentication
bind-first
6.
authentication
compare
7.
exit
You must create LDAP attribute maps that map your existing user-defined attribute names and values to Cisco attribute names and values that are compatible with the security appliance. You can then bind these attribute maps to LDAP servers or remove them as required. For more information about user-based firewalls, see the “User-Based Firewall Support” chapter in Security Configuration Guide: Zone-Based Policy Firewall.
Note | To use the attribute mapping features correctly, you need to understand the Cisco LDAP attribute names and values as well as the user-defined attribute names and values. |
1.
enable
2.
configure
terminal
3.
ldap
attribute
map
map-name
4.
map
type
ldap-attr-type
aaa-attr-type
5.
exit
6.
ldap
server
name
7.
ipv4
ipv4-address
8.
bind
authenticate
root-dn
user-name
password [0
string |
7
string]
string
9.
base-dn
string
10.
attribute
map
map-name
11.
exit
The following show and debug commands can be entered in any order.
1.
enable
2.
clear ldap server
3.
debug ldap
4.
show ldap server
5.
show ldap attributes
The following example shows how to create server group server1 and specify the IP address, transport port 200, and retransmit values:
Device> enable Device# configure terminal Device(config)# aaa new-model Device(config)# ldap server server1 Device(config-ldap-server)# ipv6 2001:DB8:0:0:8:800 Device(config-ldap-server)# transport port 200 Device(config-ldap-server)# timeout retransmit 20 Device(config-ldap-server)# exit
The following example shows how to configure the LDAP parameters:
ldap server server1 bind authenticate root-dn “cn=administrator,cn=users,dc=nac-blr2,dc=cisco,dc=com password 123” search-filter user-object-type objectclass base-dn "dc=sns,dc=example,dc=com" mode secure no-negotiation secure cipher 3des-ede-cbc-sha
The following example shows how to configure the AAA server group:
aaa new-model aaa group server ldap server1
The following example shows how to configure the sequence of search and bind operations for an authentication request:
Device> enable Device# configure terminal Device(config)# aaa new-model Device(config)# ldap server server1 Device(config-ldap-server)# authentication bind-first Device(config-ldap-server)# authentication compare Device(config-ldap-server)# exit
The following example shows how to attach the attribute map to a particular LDAP server:
ldap attribute-map map1 map type department element-req-qos exit ldap server ldap_dir_1 ipv4 192.0.2.1 bind authenticate root-dn "cn=administrator,cn=users,dc=nac-blr2,dc=example,dc=com" password example123 base-dn "dc=sns,dc=example,dc=com" attribute map map1
The following example shows how to attach the attribute map to an LDAP host running Active Directory (Microsoft) server software for successful user authentication:
ldap attribute-map map1 map type sAMAccountName username exit ldap server ldap_dir_1 ipv4 192.0.2.1 bind authenticate root-dn "cn=administrator,cn=users,dc=nac-blr2,dc=example,dc=com" password example123 base-dn "dc=sns,dc=example,dc=com" attribute map map1
Related Topic |
Document Title |
---|---|
Cisco IOS commands |
|
Security commands |
|
AAA |
“Configuring Authentication” module |
RFC |
Title |
---|---|
Lightweight Directory Access Protocol (v3): Extension for Transport Layer Security |
|
Lightweight Directory Access Protocol (LDAP) |
|
Lightweight Directory Access Protocol (LDAP): Authentication Methods and Security Mechanisms |
|
Lightweight Directory Access Protocol (LDAP): String Representation of Distinguished Names |
|
Lightweight Directory Access Protocol (LDAP): String Representation of Search Filters |
|
Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules |
|
Lightweight Directory Access Protocol (LDAP): Schema for User Applications |
Description |
Link |
---|---|
The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. |
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Feature Name |
Releases |
Feature Information |
---|---|---|
LDAP Integration with Active Directory |
Cisco IOS XE 3.3SE |
Lightweight Directory Access Protocol (LDAP) is a standard-based protocol used to access directories. It is based on the client server model similar to RADIUS. LDAP is deployed on Cisco devices to send authentication requests to a central LDAP server that contains all user authentication and network service access information. The LDAP Integration with Active Directory feature provides authentication and authorization support for authentication, authorization, and accounting (AAA). The following commands were introduced or modified: aaa group server ldap, authentication bind-first, authentication compare, bind authenticate, base-dn, clear ldap server, debug ldap, ipv4, mode secure, ldap server, search-filter, secure cipher, show ldap server, transport port, timeout, retransmit. |