OTP Server Returned Attributes Question

scamarda — Wed, 10 Oct 2018 05:05:46 GMT

I am setting up ISE 2.3 with OpenOTP. Connectivity is working between ISE and the OTP server. I'd like to return a value to ISE to place the user in a specific ASA group policy. I can get it to work when I set the OTP Server with this config

cisco-avpair ACS:CiscoSecure-Group-Id=usergroup where the usergroup is the value I would like to return.

I would like to extract the value from the LDAP department value instead of hard coding the value like above.

I've tried a few different combinations and can see the desired attribute using radtest. However the ISE does not recognize the value. I've tried attribute ASA-Group-Policy with LDAP:Department. I also modified the OTP Attribute to be both LDAP and ASA-Group-Policy. I'm not sure how that would be set up in this case though.

Can I pull a value from LDAP and return it to ISE to use to assign ASA Group Policy? If so, can you please share the syntax?

Thanks.

Sam

Re: OTP Server Returned Attributes Question

paul — Wed, 10 Oct 2018 12:42:37 GMT

I don't use LDAP but works perfect with AD. Added this to my authorization policy (using description as example from AD):

The Class attribute got added to the authorization results as expected:

topic Re: OTP Server Returned Attributes Question in Network Access Control

OTP Server Returned Attributes Question

Re: OTP Server Returned Attributes Question