topic ISE - External Identity Store - Two Factor Request Passes Token and Password in Network Access Control

ISE - External Identity Store - Two Factor Request Passes Token and Password

Phi Yim — Sat, 26 Mar 2016 00:44:37 GMT

ISE experts,

My customer is using ISE for TACACS and would like to enable two factor authentication.

They currently have their two factor authentication server configured as an external identity store which works as expected. Problem is, when ISE sends the request to the RADIUS token server for authentication, it sends the AD username/password along with the token. If an admin with access to the RADIUS token server runs a debug, they can see the user’s active directory password which they want to avoid.

Question – Is it possible for ISE to separate the authentication request? Something like this:

Supplicant sends credentials to ISE to authenticate against AD.
If AD credentials pass, supplicant sends the token to ISE to authenticate against RADIUS token server.
If pass, proceed to authorization policies.

Or alternative:

Supplicant sends AD credentials and token to ISE for authentication.
ISE authenticates credentials against AD and sends the token only to the RADIUS token server.
If it passes, then proceed to authorization policies.

Thanks for your help!

Re: ISE - External Identity Store - Two Factor Request Passes Token and Password

hslai — Sat, 26 Mar 2016 04:04:52 GMT

Neither really supported by ISE today. I think your customer's token server supporting it because it has the inside knowledge which characters belong to OTP and the reset that of AD passwords.

What supported in ISE is CWA chaining -- to use AD to perform one auth (e.g. DOT1X) and then redirect to an ISE guest portal and authenticated by token.

Re: ISE - External Identity Store - Two Factor Request Passes Token and Password

hslai — Sat, 26 Mar 2016 18:55:44 GMT

Also it is common to use different ID stores for login and enable, by using the TACACS dictionary.

Please see that is an option for your customers.

Re: ISE - External Identity Store - Two Factor Request Passes Token and Password

Phi Yim — Mon, 28 Mar 2016 21:32:18 GMT

Thanks for getting back to me. If we use different ID stores for login and enable, the problem still exist if the customer chooses two factor for enable right?

Re: ISE - External Identity Store - Two Factor Request Passes Token and Password

hslai — Mon, 28 Mar 2016 21:44:16 GMT

Yep, if customers choose it that way.

IMHO It's essential two factors with one ID store for login and another for enable so customers need not send AD credentials to OTP. Anyhow, it's up to the customers.