topic ISE not pulling all identity attributes from AD. in Network Access Control

ISE not pulling all identity attributes from AD.

jahamilton1 — Tue, 28 Mar 2017 08:43:53 GMT

I'm trying to use the device group condition to create an authorization policy based on user attributes from the AD.

It didn't work out and also got this from the report.

Code 24100 seems to be the problem. Cause I have deployed similar policy for another client and code 24100 seems to be the only strange report I can see.

Thanks.

Re: ISE not pulling all identity attributes from AD.

Oliver Laue — Tue, 28 Mar 2017 14:05:38 GMT

did you see these attributes on the client if you use the AD test tool on external identity sources?

Re: ISE not pulling all identity attributes from AD.

jahamilton1 — Tue, 28 Mar 2017 18:09:53 GMT

Yes I do. All required required attributes were pulled when I did a test

tool.

Re: ISE not pulling all identity attributes from AD.

hslai — Fri, 31 Mar 2017 03:42:46 GMT

The error implies the attribute is empty. If your AD test is done with the same user, are you seeing it differently?

For example, I configured an authz profile to return the attribute "mail" from AD. It does NOT give 24100 when the AD user has non-empty value for this attribute; whereas it gives 24100 for an user not configured for this attribute.