Ldap Attribute Mapping - Cisco FirePOWER ASA 5500 series Configuration Manual

AAA Server and Local Database Support
After you complete this fundamental configuration work, you can configure additional LDAP
authorization parameters such as a directory password, a starting point for searching a directory, and the
scope of a directory search:
hostname(config)# aaa-server ldap_dir_1 protocol ldap
hostname(config-aaa-server-group)# aaa-server ldap_dir_1 host 10.1.1.4
hostname(config-aaa-server-host)# ldap-login-dn obscurepassword
hostname(config-aaa-server-host)# ldap-base-dn starthere
hostname(config-aaa-server-host)# ldap-scope subtree
hostname(config-aaa-server-host)#
See LDAP commands in the Cisco Security Appliance Command Reference for more information.

LDAP Attribute Mapping

If you are introducing a security appliance to an existing LDAP directory, your existing LDAP attribute
names and values are probably different from the existing ones. You must create LDAP attribute maps
that map your existing user-defined attribute names and values to Cisco attribute names and values that
are compatible with the security appliance. You can then bind these attribute maps to LDAP servers or
remove them as needed. You can also show or clear attribute maps.
To use the attribute mapping features correctly, you need to understand the Cisco LDAP attribute names
Note
and values as well as the user-defined attribute names and values.
The following command, entered in global configuration mode, creates an unpopulated LDAP attribute
map table named att_map_1:
hostname(config)# ldap attribute-map att_map_1
hostname(config-ldap-attribute-map)#
The following commands map the user-defined attribute name department to the Cisco attribute name
cVPN3000-IETF-Radius-Class. The second command maps the user-defined attribute value Engineering
to the user-defined attribute department and the Cisco-defined attribute value group1.
hostname(config)# ldap attribute-map att_map_1
hostname(config-ldap-attribute-map)# map-name department cVPN3000-IETF-Radius-Class
hostname(config-ldap-attribute-map)# map-value department Engineering group1
hostname(config-ldap-attribute-map)#
The following commands bind the attribute map att_map_1 to the LDAP server ldap_dir_1:
hostname(config)# aaa-server ldap_dir_1 host 10.1.1.4
hostname(config-aaa-server-host)# ldap-attribute-map att_map_1
hostname(config-aaa-server-host)#
The command to create an attribute map (ldap attribute-map) and the command to bind it to an LDAP
Note
server (ldap-attribute-map) differ only by a hyphen and the mode.
The following commands display or clear all LDAP attribute maps in the running configuration:
hostname# show running-config all ldap attribute-map
hostname(config)# clear configuration ldap attribute-map
hostname(config)#
The names of frequently mapped Cisco LDAP attributes and the type of user-defined attributes they
would commonly be mapped to include:
Cisco Security Appliance Command Line Configuration Guide
13-8
Chapter 13 Configuring AAA Servers and the Local Database
OL-10088-01