topic Re: Restrict accessing specific data for ERS API access in Network Access Control

Restrict accessing specific data for ERS API access

masyamad — Thu, 30 Aug 2018 15:33:44 GMT

Hi dev team,

Now my customer is considering specific admin user can access only some specific network user group.

It could be achieved by admin authorization policy. (Administration -> Authorization -> Policy).

It does work as expected, but when we tried to configure same user group via ERS API, we faced un-authorized error. Do we need special configuration for restrict data area via ERS API access?

Re: Restrict accessing specific data for ERS API access

hslai — Thu, 30 Aug 2018 16:25:35 GMT

ERS API does not follow the same RBAC as those used in ISE admin web UI. I believe you need to discuss this requirement with our PM team and raise it as an enhancement.

Re: Restrict accessing specific data for ERS API access

masyamad — Thu, 30 Aug 2018 23:02:42 GMT

> ERS API does not follow the same RBAC as those used in ISE admin web UI.
I see. Thanks. Actually I & my customer didn't notice the implementation during design session for admin access.
I hope the behavior is documented on admin access section on ISE guides.

- ISE guides: Admin Access Policies
https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_0101.html

Re: Restrict accessing specific data for ERS API access

hslai — Fri, 31 Aug 2018 23:22:38 GMT

Prerequisites for Using the External RESTful Services API Calls says,

You must have External RESTful Services Admin privileges.

Re: Restrict accessing specific data for ERS API access

masyamad — Wed, 12 Sep 2018 00:56:07 GMT

Thanks. But it's different URL. I hope Admin Access Policies also has similar description.