Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an ASA 5520 and am trying to set up a remote access SSL VPN authenticating against AD using LDAP. Between these two guides:

I've cobbled together something that works for at least one user. My main problem going forward is this: I'm using a program called ldp.exe to navigate active directory via LDAP I see the OU's my users are located under and I see the CN entries for the individual users. The way we have our AD setup, the CN entires look like < last name >./ < first name > (example: Smith,/ John) because we have their display names in AD set up as last name comma first name. I can't give my VPN user names like Smith,/ John to log in to the VPN.

My question is: Is there another attribute I can use to set as their username on the VPN?

Any help is appreciated.

share|improve this question
Please post the relevant config lines from your ASA. – smithian Oct 23 '12 at 20:54

This should work. If you are using sAMAccountName as your ldap-naming-attribute, it doesn't matter what the CN looks like. the sAMAccountName should be the same as the pre windows 2000 name in the properties page of the user.

This is a working LDAP server config from my ASA

aaa-server ldapserver (inside) host
 server-port 3268
 ldap-base-dn dc=domain,dc=com
 ldap-scope subtree
 ldap-naming-attribute sAMAccountName
 ldap-login-password *
 ldap-login-dn CN=ldapuser,OU=someou,DC=domain,DC=com
 server-type microsoft
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.