topic Re:Problem with getting LDAP attributes on ISE when EAPChaining in Network Access Control

Problem with getting LDAP attributes on ISE when EAPChaining is enabled

Karel Navratil — Mon, 11 Mar 2019 02:39:16 GMT

Hi All,

has anybody and idea how to set LDAP attributes retrieval with EAPChaining enabled?

My scenarios is:

- user with AnyConnect (EAP-FAST) connects to WLAN and sends it's credentials

- ISE authenticates username and password against Active Directory

- ISE should check if the same userid contains in LDAP Directory (not AD, different store) special attribute which controls access to our WLAN

- If the attribute is found, then authorization profile is matched.

This works when I disable EAP-Chaining Policy -> Policy Elements -> Results -> Authentication -> Allowed Protocols ...

In logs I've found that the user was not found in LDAP, but the user exists.

Maybe the workaround can be if just user from EAPChaining is used and not also the hostname, then it could match. But I cannot find any similar parameter which returns only user.

Does anybody have an idea how to solve this?

Thanks!

Re:Problem with getting LDAP attributes on ISE when EAPChaining

Tarik Admani — Tue, 09 Oct 2012 14:55:18 GMT

Hi,

This seems like a corner issue, because eap-fast with ldap is not supported. LDAP as the protocol doest support hash based authentication hence the reason ISE is failing to hit the ldap database.

Referencing acs material since ise docs are not complete:

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.2/user/guide/eap_pap_phase.html

Sent from Cisco Technical Support Android App

Re:Problem with getting LDAP attributes on ISE when EAPChaining

Karel Navratil — Tue, 09 Oct 2012 14:58:55 GMT

Hi,

I'm not using LDAP to authenticate just as additional attribute retrieval. Authentication is done via Active Directory.

Just want to have control who can access our WLAN and who not and take advantage of EAP-Chaining

Re:Problem with getting LDAP attributes on ISE when EAPChaining

Tarik Admani — Wed, 10 Oct 2012 01:30:45 GMT

Do you have your ldap group configured as an authorization condition?

I remember an topic on the forums where the retrieval is done when the authorization rule has the ldap group as a condition. Then ise will attempt the lookup.

Sent from Cisco Technical Support Android App

Re:Problem with getting LDAP attributes on ISE when EAPChaining

Karel Navratil — Wed, 10 Oct 2012 07:31:48 GMT

It's not LDAP group based, just additional attribute WLANProfile which returns to which VLAN should the user be connected.

If the it matches ie Employees, then access is granted.

This works fine when EAP Chaining is disabled in protocols, when I enable it stops matching.

Re:Problem with getting LDAP attributes on ISE when EAPChaining

Karel Navratil — Sun, 14 Oct 2012 21:20:36 GMT

Any ideas here?