Explanation
When ASA needs to authenticate a user to the configured LDAP server, it first tries to login using the login
DN provided. After successful login to the LDAP server, ASA sends a search query for the username provided
by the VPN user. This search query is created based on the naming attribute provided in the configuration.
LDAP replies to the query with the complete DN of the user. At this stage ASA sends a second login attempt
to the LDAP server. In this attempt, ASA tries to login to the LDAP server using the VPN user's full DN and
password provided by the user. A successful login to the LDAP server will indicate that the credentials
provided by the VPN user are correct and the tunnel negotiation will move to the Phase 2.
Source:
http://www.networkworld.com/article/2228531/cisco-subnet/using-your-active-directory-for-vpn-
authentication-on-asa.html