topic Re: Multiple Matches for users with two AD accounts. in Network Access Control

Multiple Matches for users with two AD accounts.

joeharb — Thu, 29 Apr 2021 13:36:13 GMT

We have specific users that have both an Admin account and a normal account. We are using EAP-TLS and have found that they fail authentication. ISE responds with a:

	24324	Identity resolution detected multiple matching accounts
	24417	User's Groups retrieval from Active Directory failed

The radius user name is from the first.lastname@csiweb.com. I am trying to determine what attributes are being retrieved that makes it think that the accounts are the same...the sAMAccount and UPN are different in AD.

Would the debug logs give me some of this information?

Thanks,

Joe

Re: Multiple Matches for users with two AD accounts.

joeharb — Thu, 29 Apr 2021 14:35:29 GMT

Currently we are using Subject Alternate Name, I think I can change this the Common Name to resolve the issue, is there a best practices or which fits best for that particular deployment.

Thanks,

Joe

Re: Multiple Matches for users with two AD accounts.

hslai — Sat, 01 May 2021 05:58:12 GMT

CSCvu35802 Shared email for AD users fail to retrieve groups,ISE shows multiple account found in forest

might be what you are hitting.

Re: Multiple Matches for users with two AD accounts.

joeharb — Mon, 03 May 2021 16:28:24 GMT

Thanks for the response, in looking at the Bug, I don't know if I can change to UPN as the UPN reflects our internal domain @csi.corp, while the username is @csiweb.com (from the Subject Alt Name). I am going to test with the Certificate profile change the Common Name as that seems to be unique.

Thanks,

Joe