topic Re: Integration between ISE and ADFS in Network Access Control

Integration between ISE and ADFS

rlandire — Mon, 13 Nov 2017 20:35:29 GMT

Hi team,

I am looking from some help, we are doing an onsite demo with one of our customers in Ecuador. For this, we need to use MS ADFS as SAML provider to ISE. We have been searching about how to do this integration but looks like it is not well documented. As we understand the main problem with this is how to map the attributes returning from ADFS to ISE.

https://cisco-marketing.hosted.jivesoftware.com/message/248362

Also we have opened a case with TAC and they suggest to use a third party vendor for this integration (Ping Federate).

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-21/200545-Configure-ISE-2-1-Sponsor-Portal-with-Pi.html

Please may you confirm if this integration is possible without using a third party vendor? if the answer is yes please may you provide some details about how to do this integration?

Best regards,

Robert Landires

Re: Integration between ISE and ADFS

hslai — Mon, 13 Nov 2017 20:39:41 GMT

Yes, I will unicast you the info I have.

Re: Integration between ISE and ADFS

rlandire — Mon, 13 Nov 2017 23:45:36 GMT

Thank you very much Hsing-tsu

Re: Integration between ISE and ADFS

jan.murin — Mon, 07 May 2018 08:38:56 GMT

Hi, got the same problem. Would like to know how to integrate the ISE (version 2.3) with the ADFS.

Thanks a lot!

Re: Integration between ISE and ADFS

hslai — Sun, 02 Sep 2018 02:10:46 GMT

I need your email address to share a copy of my notes, which were written for our internal use only ~ 20 months ago. It needs re-validated before publishing here. Incidentally, Cisco TAC is working on a similar article.

[2018-May-11] I published it a blog -- Notes on ADFS as SAML IdP for ISE User Portals after some clean-ups.

Re: Integration between ISE and ADFS

jan.murin — Wed, 15 Aug 2018 09:41:38 GMT

Hi,

I came back here after some time. I have read the official document how to integrate sponsor portal with AD FS (https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-23/213352-configure-ise-2-3-sponsor-portal-with-ms.html).

I have to admit that I do not have any knowledge how ADFS works, but we got a problem with the SSO.

We done all the steps described in the document, however the domain user (on a domain computer) is always redirected to the ADFS webpage to enter his credentials before entering the sponsor portal.

I thought that when using ADFS for SSO, the domain user will not be required to enter the credentials anywhere. The user has logged into the computer so the ADFS system should have the credentials and therefore should automatically log the user into the sponsor portal without any intervention from the user.

Or I am missing something?

Thanks a lot!

Re: Integration between ISE and ADFS

hslai — Sun, 02 Sep 2018 02:11:55 GMT

In my notes, I put this as a bullet item:

(ADFS) Update the global settings of the primary authentication to Forms Authentication, because ISE is not supporting other authentication methods (CSCvb32728)

Re: Integration between ISE and ADFS

jan.murin — Mon, 03 Sep 2018 12:46:29 GMT

Hi,

we have that set as described, but still no luck. The user is still redirected to the ADFS portal where the credentials are requested.

To be sure, does the SSO working for the sponsor portal without any interaction from the user?

Re: Integration between ISE and ADFS

hslai — Mon, 03 Sep 2018 15:28:53 GMT

Using SAML with ISE is currently supported with form-based authentication so it's expected to redirect to the ADFS portal to login.

I think you are expecting Kerberos auth. For ISE Sponsor Portal, ISE 2.4 has a new option for Kerberos auth -- Portal Settings for Sponsor Portals:

...

Allow Kerberos—Use Kerberos to authenticate a sponsor for access to the sponsor portal. Kerberos SSO is performed inside the secure tunnel after the browser establishes the SSL connection with ISE.

...

Re: Integration between ISE and ADFS

jan.murin — Tue, 04 Sep 2018 06:08:08 GMT

Hi,

thanks for that information. Going to test version 2.4.

Regards,

Jan

Re: Integration between ISE and ADFS

scott.stapleton — Fri, 21 Sep 2018 16:45:29 GMT

Hi Jan,

I'm curious if you had luck with getting SSO working with 2.4?

Cheers,

Scott

Re: Integration between ISE and ADFS

jan.murin — Mon, 24 Sep 2018 06:44:11 GMT

Hi Scott,

Not for now, I played with it for a long time without success.

Still waiting for some help from the local cisco guy, so maybe in the near future I will have more information.