topic Re: How to create Multiple admin user easily in ISE in Network Access Control

How to create Multiple admin user easily in ISE

Abhijith Mepparabath — Wed, 06 May 2020 12:22:57 GMT

Hello,

I have been trying to find out an easy way to create multiple Local admin user who can authenticate with external identity source like RSA .

I tried to use ERS API request but it didn't give me the required output ,i could able to created internal users with the API request but not admin users.

Is it possible to create create multiple Local admin user who can authenticate with external identity source in ISE via ERS API request?

If not can any one suggest me any possible solution for this.

Thanks

Re: How to create Multiple admin user easily in ISE

Mike.Cifelli — Wed, 06 May 2020 12:50:33 GMT

AFAIK, as you stated, with the APIs you can only create internal users. Relating to admin users the API allows 'get-by-id', 'get-all', & 'get-version'. That info can be found in the SDK API documentation. HTH!

Re: How to create Multiple admin user easily in ISE

Abhijith Mepparabath — Thu, 07 May 2020 09:25:16 GMT

Thanks!

Is there any other way to create multiple admin user easily .

Re: How to create Multiple admin user easily in ISE

Mike.Cifelli — Sat, 09 May 2020 15:43:49 GMT

Your best bet would be to utilize an external source such as AD security groups and add admin users to each respective group in AD for how you want to divide roles. Then reference that Admin Group in your RBAC Policies for Admin Access & grant permissions (menu/data) as you wish.
Create Admin Group: Administration->System->Admin Access->Administrators->Admin Groups
Map to RBAC Policy: Administrations->System->Admin Access->Authorization->Policy
Good luck & HTH!

Re: How to create Multiple admin user easily in ISE

Greg Gibbs — Sun, 10 May 2020 23:52:34 GMT

It sounds like what you are trying to do is create bulk 'shadow' admin user accounts to use in conjunction with MFA (RSA) authentication/authorisation for the ISE GUI. Since ISE still performs local Authorisation when it comes to admin flows using MFA, these admin accounts (with no password) must be created and mapped to the proper RBAC group in ISE.

There is currently no mechanism for using the API or an Import option for creating admin users. These 'shadow' accounts will have to be individually created in the GUI.

Re: How to create Multiple admin user easily in ISE

pavagupt — Mon, 11 May 2020 06:31:50 GMT

unfortunately, there is no API for us to create bulk RBAC admins.. At this point of time, there is no easy way for rbac admins..