topic ACS 5.1 Authorization Policy matching Identity Groups in Network Access Control

ACS 5.1 Authorization Policy matching Identity Groups

rhodrijenkins — Mon, 11 Mar 2019 00:08:16 GMT

Hi Has anyone managed to get an Auth Policy within an Access Service to match devices based on Identity Group Membership?

My Auth Rule looks like this but doesn't ever got hit???

Re: ACS 5.1 Authorization Policy matching Identity Groups

Jatin Katyal — Fri, 14 May 2010 22:43:36 GMT

Hi,

When you say devices based on identity group membership, do you mean external groups because I could see that you have selected AD in your compound condition. Looks like you have added this attribute inside the Active directory > directory attributes.

If this is for ACS internal groups then we may try some more stuff

Regds,

Do rate helpful posts-

Re: ACS 5.1 Authorization Policy matching Identity Groups

rhodrijenkins — Mon, 17 May 2010 08:39:47 GMT

Hi JK,

This is using internal groups. The compound condition I'm using matches System:IdentityGroup in All Groups:IPPhones. Then the phone in question is a member of the ID group IPPhones. I've also tried setting the compound condition to Internal Users:UserIdentityGroup in All Groups:IPPhones but still to no avail.

Thanks

Rhodri

Re: ACS 5.1 Authorization Policy matching Identity Groups

Jatin Katyal — Mon, 17 May 2010 12:05:29 GMT

Lets try this way. VPN is an internal group and firewall is an device here.

Re: ACS 5.1 Authorization Policy matching Identity Groups

jintao99 — Mon, 17 May 2010 19:29:15 GMT

I have almost the exact same matching policy and it works fine.

Does your authentication pass successfully? What does the AAA report tell you? Maybe it hits other rules first.

Thanks,

Tao

Re: ACS 5.1 Authorization Policy matching Identity Groups

rhodrijenkins — Tue, 18 May 2010 14:40:54 GMT

Hmmm all very strange. I configured this on an Eval copy of ACS. This morning the real box arrived so once installed I'll try this again and report the results back here.

Thanks gentlemen for your assistance

Rhodri