Active Directory status via API

SecurityEng99 — Tue, 25 Oct 2022 17:23:17 GMT

How to get the Active Directory status in the ISE External Identity Sources via the API ??

I'm using the REST API below and I can see there is no users and no groups returned in the API response, but nothing about the status.

https://x.x.x.x:9060/ers/config/activedirectory/<Name>

Please let me know if there is a way to get the status information via the API. I'm using ISE 2.7 and latest patch.

Re: Active Directory status via API

Greg Gibbs — Tue, 25 Oct 2022 23:15:23 GMT

This status is not something that is currently returned by the ERS API in any shipping versions of ISE (including 3.2).

The only option I can think of would be using the 'getGroupsByDomain' PUT call to query the domain for a group. If you get a '200 OK' response, that would indicate that at least the PAN status is Joined. If you get a '500 Internal Server Error' response, that would indicate Not Joined.

https://developer.cisco.com/docs/identity-services-engine/v1/#!activedirectory

Example:

{
"OperationAdditionalData" : {
"additionalData" : [
{
"name" : "domain",
"value" : "{{ad_domain_name}}"
},
{
"name" : "filter",
"value" : "*Domain Computers"
}
]
}
}

You could also submit a request for this to be added to the API via https://cs.co/ise-feedback.

topic Active Directory status via API in Network Access Control

Active Directory status via API

Re: Active Directory status via API