topic ISE 2.4 Authentication - Identity Groups unavailable in Network Access Control

ISE 2.4 Authentication - Identity Groups unavailable

ssschunk1 — Fri, 27 Sep 2019 15:42:13 GMT

It was pointed out that our default policy set was not configured for best practice. We had been pointing the default authentication to our RSA service. In an attempt to change the default to deny access, I had to come up with a limiting method to prevent unnecessary/unacceptable request from being passed to the RSA service. I thought I would use an AD group as a userid cache to qualify what userids would be sent onto the RSA service. In addition, I am focused in the device admin section and the authentication I am handling is a tacacs communication. As I dug into it I quickly discovered I could not manually define an AD group criteria nor could I use the previously created AD identity groups that I use in the authorization policy sets. In fact, no identity groups are available when clicking on that icon in the authentication set. My sad work around is this: because we have standardized user account name, I took the tacacs username and qualified based on matching beginning characters of the usernames... While this works, that set is far greater than the userids I want to forward to our RSA service. Is this limitation engineered by design? Am I looking at Authentication in the wrong way?

Re: ISE 2.4 Authentication - Identity Groups unavailable

Damien Miller — Fri, 27 Sep 2019 17:12:43 GMT

It sounds like you might be missing a step, but my bad if I misunderstood the issue. In order to have AD groups available for use within ISE policy sets, or admin access areas, you need to "add" them to ISE.
1. navigate to https://<ISE_IP>/admin/#administration/administration_identitymanagement/administration_identitymanagement_external
2. Click on your AD connector
3. In the middle of the page you will have a "groups" tab, click it.
4. Search and add AD groups you would like to leverage within ISE.

At this point you will have them available when you are creating radius/tacacs rules.

Re: ISE 2.4 Authentication - Identity Groups unavailable

hslai — Sun, 29 Sep 2019 16:52:24 GMT

You are correct on this. This is by the current design of ISE that ID groups available during authorization only but not during authentication.

Re: ISE 2.4 Authentication - Identity Groups unavailable

ssschunk1 — Wed, 02 Oct 2019 15:41:51 GMT

Thanks. Not really the answer I wanted and it really limits my authentication options. Any insight on this becoming a future feature add?