In an AAA group scenario, if LDAP misconfiguration prevents access, which misconfiguration is most likely?

• A. The Authorization policy is not configured properly.
• B. The group attribute is not configured in the LDAP policy.
• C. AAA group names are not the same as those in Active Directory.
• D. LDAP Base DN is incorrect.

Answer: (D)

The key idea is how LDAP looks up the user and their groups. In an AAA group setup, the appliance queries LDAP starting from a Base DN to locate the user entry and then retrieve its group memberships to decide authorization. If the Base DN is wrong, the LDAP search starts in the wrong part of the directory and can’t find the user or their associated groups. That means authentication may fail to establish a valid user and the subsequent group-based authorization cannot occur, effectively blocking access at the LDAP lookup stage.

Other misconfigurations can also cause access issues, but they don’t directly prevent the initial LDAP lookup from locating the user entry. For example, if the authorization policy is off, credentials might be valid but access is denied by policy; if the group attribute isn’t configured, group mapping may fail; if group names don’t match AD, authorization mapping fails. However, these scenarios hinge on later steps after a successful LDAP search, whereas an incorrect Base DN blocks the LDAP search itself.