topic ISE 2.2 One-Click Approval in Network Access Control

ISE 2.2 One-Click Approval

terdean — Wed, 08 Mar 2017 18:58:09 GMT

Is there a way to utilize the schema options to map the email attribute to the UPN field? I have a customer that wants to use the one-click approval but the email attribute that is associated with the active directory user accounts are not being used. When they send emails out to users, they send it to the address within the UPN field.

Re: ISE 2.2 One-Click Approval

Jason Kunst — Wed, 08 Mar 2017 19:07:59 GMT

I will check, pretty sure the answer is no

https://communities.cisco.com/docs/DOC-70777

What type of accounts are able to use the single click with token?

The sponsor email address must be populated under the AD or LDAP account Email.

ISE AD/LDAP schema is already mapped out of box when configured.

Administration > Identity Management > External Identity Sources > Active Directory > domain > Advanced Settings > Schema

Re: ISE 2.2 One-Click Approval

Jason Kunst — Mon, 20 Mar 2017 17:15:35 GMT

How about this, under the user info attributes put the UPN in for email, this will map your UPN to the email address field on ISE

Re: ISE 2.2 One-Click Approval

Thibault BRISSE — Sat, 01 Apr 2017 17:23:15 GMT

Using a custom schema doesn't work......I've opened a case at Cisco few weeks ago, it should be an enhancement in the future.

I can't use use the one click feature because of that :

ENH: One-Click approval does not work with the "Only accounts assigned to this sponsor" option.

CSCvd29533

This enhancement is not expected in the first patch. For me it's a bug since I can't use this feature.

Re: ISE 2.2 One-Click Approval

Jason Kunst — Sat, 01 Apr 2017 18:08:22 GMT

i checked with development and they said to try what I listed above

if not please list the bug you had for that

the other issues is known defect working with development on

Re: ISE 2.2 One-Click Approval

Thibault BRISSE — Mon, 03 Apr 2017 13:15:00 GMT

I've just received the BUG ID for the schema : CSCvd85620. It may not be visible at this time but it should be soon.

Apparently, they've released the one click feature without try it :-).