NSD1178 How to set Juniper SSL / VPN remote access policies based on the group membership from ldap user database

Fact

One Time Password Server

Juniper SA SSL/VPN

SituationSetting Juniper SSL/VPN remote access policies based on the group membership from LDAP User

database with Nordic Edge One Time Password Server

Solution Step 1. - Installing Nordic Edge plugin RADIUSAttributeGroupMembership Copy attached file RADIUSAttributeGroupMembership.class in directory <OTPServer>/ext Copy attached file groupmembership.cfg in directory <OTPServer> Step 2.- Configuring OTPServer RADIUS Client Select Radius & Client tab

Highlight Radius Client

Select “Edit Client”

Highlight User DatabaseSelect Options

Select Add OptionConfigure Radius Attribute as follows:

Select OK to save attribute value configuration.

Select OK to save Radius attribute configuration. Step 3. - Configuring group membership filter Choose user groups from LDAP user database.As an example groups: VPN-user,VPN-helpdesk,VPN-support,VPN-admins will be used. Step 3.1 Modify groupmembership.cfg For Microsoft Active Directory Modify groupmembership.cfg: GroupNameTag=Groupname:Separator=,GroupsToCheck=VPN-user,VPN-helpdesk,VPN-support,VPN-adminsUserIDAttribute=samaccountnameGroupMemberAttribute=memberOf For Novell eDirectory Modify groupmembership.cfg: GroupNameTag=Groupname:Separator=,GroupsToCheck=VPN-user,VPN-helpdesk,VPN-support,VPN-adminsUserIDAttribute=CNGroupMemberAttribute=groupmembership4- Configuring Juniper SSL/VPNStart Juniper Central Manager, select Users / User Roles and create roles matching the GroupsToCheck list from groupmembership.cfg.In this example four roles are created:VPN-User, VPN-Helpdesk, VPN-Support and VPN-Admins

Select Users / Users Realms and open your Realm. In this example the Realm is called “User”.On the General Page make sure the Directory / Attribute is set to “Same as above”.

Select the page “Role Mapping” and configure the Rule based on “User attribute”

Select “Update”

In this example Role Mapping Rule for Role VPN-User is created as shown below:Select Attribute Class (25)Choose “Is” and write group name including GroupNameTag from groupmembership.cfg, i.e “Groupname:VPN:user”Assign rule to Role “VPN-User”

Save changes and repeat for all user groups in the GroupsToCheck list from groupmembership.cfg.

When completed, this example's configuration looks like the following:

The Juniper policies are now matching user group membership set in the LDAP user database and groupmembership.cfg.