topic Query specific AD group using certificate common name in Network Access Control

Query specific AD group using certificate common name

Antonio Macia — Thu, 05 Apr 2018 13:54:59 GMT

Hello,

How can I check if an username retrieved from the certificate common name belongs to a specific AD group? In the policy set I can match against the general AD as an external group object (have a look at the attached screenshot) so ISE performs a lookup among all AD groups but, is it possible to reference the exact AD group?

I need to create different authorization rules for my 802.1x wireless clients based on the AD group they belong to.

Regards.

Re: Query specific AD group using certificate common name

hslai — Thu, 05 Apr 2018 14:27:58 GMT

If your ISE is of 2.x and fresh install, then there should be a Preloaded_Certificate_Profile with Use Identity From set to Subject - Common Name. If this is not there, you may create one with similar settings.

Then, select it for authentication and the AD group/attribute lookups in authorization will be using the common name field as the username.

BTW... I do not think your existing condition would work well as the AD external groups in ISE 1.3+ are represented in SIDs.

Re: Query specific AD group using certificate common name

Greg Gibbs — Fri, 06 Apr 2018 00:10:43 GMT

The CAP that Hsing mentions is how you identify what attribute in the certificate is used for identity (i.e. Common Name, etc). If you want to check that credential against your AD as part of the Authentication stage, you would also need to select your AD in the Identity Store dropdown box.

You can provide differentiated access for different AD user groups in the Authorisation Policy using the <AD>:ExternalGroups EQUALS <group> attribute.

-Regards

Greg

Re: Query specific AD group using certificate common name

Antonio Macia — Mon, 16 Apr 2018 15:57:19 GMT

Thanks Gregory and hslai.

I was creating the AuthZ conditions from the Policy Set menu instead from the Library Conditions and couldn't find the group selection.