topic Re: Certificate Authentication Profile (CAP) - Identity Store Query in Network Access Control

Certificate Authentication Profile (CAP) - Identity Store Query

dot1x — Sun, 27 Aug 2017 03:06:12 GMT

Hi Members,

When we have Certificate Authentication Profile setup and haven't setup Identity Sequence in Authentication Profile, which Identity Store would ISE look for attributes mentioned in CAP Policy?

Re: Certificate Authentication Profile (CAP) - Identity Store Query

hslai — Mon, 28 Aug 2017 02:25:58 GMT

The certificate attribute designated for the user identity is used as the subject/user to lookup for groups/attributes in identity stores as specified in the authorization policy rules. They can be any internal or external identity stores configured in ISE.

Re: Certificate Authentication Profile (CAP) - Identity Store Query

dot1x — Wed, 30 Aug 2017 01:02:53 GMT

What about the authentication part?

For Authentication, would it check the ID Store specified in Authorization rule?

Re: Certificate Authentication Profile (CAP) - Identity Store Query

hslai — Wed, 30 Aug 2017 01:16:09 GMT

It depends on Steps 3 ~ 5 of Add a Certificate Authentication Profile

In case that no identity store chosen in Step 3, then ISE uses those certificates designed for client authentication in Trusted Certificates only.

Re: Certificate Authentication Profile (CAP) - Identity Store Query

dot1x — Wed, 30 Aug 2017 01:25:33 GMT

Thanks hslai.

Could you please have a look at the attached CAP Profile?

Would it be checking ID Store specified in Authorization Rule?

If yes, what happens during Authentication? How would the user get authenticated?

Re: Certificate Authentication Profile (CAP) - Identity Store Query

hslai — Wed, 30 Aug 2017 01:36:24 GMT

The "Identity Store" is set to [not applicable] so the authentications will be based on trusted certs only. ISE will still perform groups/attributes lookup using the subject alternative name as user name if your authorization policy rules are using those identity stores.

Re: Certificate Authentication Profile (CAP) - Identity Store Query

dot1x — Wed, 30 Aug 2017 01:41:15 GMT

Thanks hslai, that makes sense.

Correct me if I'm wrong:

Authentication Part: If user certificate is from trusted CA, the user gets authenticated and no ID Stores would be checked.

Authorization Part: Subject Alternative Name would be checked in the ID stores as per Authorization Policy.

Re: Certificate Authentication Profile (CAP) - Identity Store Query

hslai — Wed, 30 Aug 2017 01:43:14 GMT

Correct.

Re: Certificate Authentication Profile (CAP) - Identity Store Query

dot1x — Wed, 30 Aug 2017 01:49:10 GMT

Is there any basic config example for certificate based authentication both for ISE and Client side?

Re: Certificate Authentication Profile (CAP) - Identity Store Query

hslai — Wed, 30 Aug 2017 02:17:47 GMT

ISE Training has links to various materials.

We have some GOLD labs via SalesConnect but these offerings are ending this Thursday.

BYOD -- shows using ISE BYOD to provision a certificate to an Apple iDevice using ISE internal CA

Integrating ISE with Active Directory -- shows using GPO in AD to provision certificates and authorize using AD.

Re: Certificate Authentication Profile (CAP) - Identity Store Query

dot1x — Wed, 30 Aug 2017 03:12:35 GMT

Thanks hslai for your comments and suggestions.