What causes authentication failures on a Cisco WSA when LDAP is used for authentication?

The Cisco Web Security Appliance (WSA) has a specific limitation when using LDAP for user authentication. The authentication process will fail if a user's passphrase contains any characters that are outside the 7-bit ASCII character set. This is because the WSA's LDAP client implementation does not correctly handle multi-byte or extended characters (such as those found in UTF-8, e.g., ñ, é, ü) when transmitting credentials to the LDAP server. This constraint is explicitly noted in the official Cisco AsyncOS documentation for the Web Security Appliance.

A. The WSA does not enforce a minimum password length; this policy is managed by the backend LDAP directory (e.g., Active Directory).
C. The characters ‘@ # $ % ^’ are all standard 7-bit ASCII characters and are supported for use in passphrases.
D. A 50-character passphrase length is generally supported. Failures are related to character encoding, not typically this specific length.

1. Cisco AsyncOS 14.0 for Web Security Appliances User Guide

Chapter 11: Authenticating Users

Page 11-13

Section: "Creating an LDAP Authentication Scheme". The guide includes a specific note: "Note – When using LDAP authentication

the password must contain only 7-bit ASCII characters."

2. Cisco Content Security Management Appliance Configuration Guide

13.5

Chapter 10: System Administration

Section: "External Authentication with LDAP". This guide reiterates the same limitation for LDAP integration across Cisco security appliances: "The password must contain only 7-bit ASCII characters."