topic Re: Authorization without Authentication in Network Access Control

Authorization without Authentication

matthen — Tue, 23 May 2017 19:56:13 GMT

Is it possible to use ISE for authorization without authentication? My use case centers around using ISE to authorize SSLVPN connections in an SSO configuration, without having to supply credentials for authentication. In this use case we would validate a user certificate on an ASA, and if it's accepted the ASA would pass the username over to ISE for group membership lookup in AD. Based on the group memberships that are returned from AD, ISE would send back authorization permissions to the ASA.

Thanks,

Matt

Re: Authorization without Authentication

hslai — Tue, 23 May 2017 20:05:52 GMT

See VPN certificate auth using ISE?

Re: Authorization without Authentication

matthen — Tue, 23 May 2017 21:20:59 GMT

Thank you! This was helpful, but do you know if there is a way to pass back a name from the certificate itself, like UPN or CN, and look that up in AD to get group membership(s) to determine which authorization policy to apply?

Re: Authorization without Authentication

hslai — Wed, 24 May 2017 19:55:31 GMT

Around 06:00 in this labminutes video How to Configure Cisco SSL VPN AnyConnect Client Certificate and Double Authentication (Part 2) shows the key is to continue with authentication failures.