topic ISE: question to Fetch groups" & "Fetch attributes" used by ISE in the ODBC in Network Access Control

ISE: question to Fetch groups" & "Fetch attributes" used by ISE in the ODBC

ujundt@cisco.com — Thu, 04 May 2017 16:28:36 GMT

Hi Team,

has maybe anybody experience in migration from ACS to ISE and the following problem?

".. Actual we are running an ACS 4.2 connected to an Oracle DB.

The idea is (and we need a solution asap) is to connect ISE to the same Oracle DB using different stored procedures.

There is a complex process running to bring the needed data into the Oracle DB (means that it is impossible to change something on the DB layout).

The team spent a lot of time reading docs on cisco.com looking for a clear description about stored procedures etc. but it seems that the given examples are incomplete or wrong.

I kindly ask you to provide a solution as soon as possible. If you need further information feel free to call me...

some technical details:

client (PC) authentication and authorization (Vlan assignment) was done with ACS 4.2 and external data source oracle using a stored procedure (as defined in the ACS manual).

Now we migrate to ISE and realize, that only half of the procedure (authentication) is working. For the assignment of users to groups (authorization) we have to use a different procedure which is in best case vaguely described.

What is now needed is the exact documentation of the interface ("Fetch groups" & "Fetch attributes" used by ISE in the ODBC Identity source, so we can program the oracle procedure accordingly...."

thanks uwe

Re: ISE: question to Fetch groups" & "Fetch attributes" used by ISE in the ODBC

howon — Thu, 04 May 2017 16:56:54 GMT

You will need to send result code of '0' and the list of groups that the user is member of or all the attributes that user record holds. The admin guide should provide what you need:

Cisco Identity Services Engine Administrator Guide, Release 2.1 - Manage Users and External Identity Sources [Cisco Ide…

Also, sample procedures shown for MS SQL & Postgres SQL:

Configure ISE 2.1 with MS SQL using ODBC - Cisco

Configure ODBC on ISE 2.1 with PostgreSQL - Cisco

Hosuk

Re: ISE: question to Fetch groups" & "Fetch attributes" used by ISE in the ODBC

hslai — Sat, 06 May 2017 22:02:36 GMT

The sample functions or stored procedures for each supported DBMS vendors are on ISE admin web UI, too.