topic Re: ISE-Admin access: Extra condition with external Username "contains/starts" with "x" ? in Network Access Control

ISE-Admin access: Extra condition with external Username "contains/starts" with "x" ?

mvassigh — Mon, 26 Feb 2018 17:18:29 GMT

Dear experts,

while migrating some ACS solution, our partner is challenged with an option, that exists in ACS 5.x, but seems to be hard to build in ISE.

The goal is to trigger and authorize with an "external AD membership", which is fine, but then also "Require the Username" to fulfill an extra condition = (example) "Begins with A".

So any ISE-Admin, who could authenticate and achieve a "Super-Power-Role", not only is member of a specific AD-Group, but also has been assigned a "Username = Starts with A". Only if both match, he would achieve the "Super-Power-Role".

Reason beeing, that structured User-Naming was enforced with this condition, whereas membership for other users in the same AD group could not be prevented.

We had a look at various UI elements, but did not achieve to find a way to squeeze this "Condition check" into the Authorization rules.

All we are offered is "External Group, whereas ACS has this setting as shown below.

Kind regards

/michael

Re: ISE-Admin access: Extra condition with external Username "contains/starts" with "x" ?

gbekmezi-DD — Mon, 26 Feb 2018 18:15:11 GMT

Would this work for you?

I just tested with Network Access:UserName STARTS_WITH as well as TACACS:User STARTS_WITH and they both work.

George

Re: ISE-Admin access: Extra condition with external Username "contains/starts" with "x" ?

mvassigh — Mon, 26 Feb 2018 19:21:25 GMT

Dear George,

thanks for highlighting the option, but would this apply for ISE-UI login process as well ?

I thought Network-Access is for "Pass-Through" not "Pass-To" Authentications, meaning that "some device" is asking for Authentication-Services, versus ISE-UI itself is asking for that.

Does that make sense ?

regards

/michael

Re: ISE-Admin access: Extra condition with external Username "contains/starts" with "x" ?

gbekmezi-DD — Mon, 26 Feb 2018 19:45:11 GMT

Sorry Michael, I misinterpreted your question! I think the only way to accomplish what you want to do with ISE is to have those users with the “A” accounts be a member of a user group in the directory….so they could be a member of the “A” group to gain access to ISE administration. I was reading your request as device administration for some reason.

George