Using only SAML can you apply a per-user ACL for AnyConnect on ASA?

[Philip D'Ath]

I'm using Cisco AnyConnect on ASA against Cisco Duo. SAML is being used for authentication.

Is there a SAML role I can push (from Duo) to apply a per-user ACL (like a RADIUS Filter-Id), instead of having to use some other authorisation option like RADIUS or Dynamic Access Policy?

[Milos_Jovanovic]

Hi @Philip D'Ath,

As far as I know, no, this is not possible. Reason for this is that ASA can't use attributes received in token for authorization.

I'm always using SAML for atuhentication, with additional authorize-only RADIUS server (almost always ISE).

BR,

Milos