Hi @vigogne and @ppreenja
I have not scanned the Community questions in a little while and this one passed me by. But I have a solution for you. Did you find a solution in the end?
It so happens that I saw this work in a customer and it's quite unbelievable.
The trick is to tell the MyDevices Portal to NOT use AD or ISE Local users as the Authentication source, but use ISE Loopback addresses instead. WHAT? ISE has loopback addresses as an Identity Source? No, not by default, but this is where the hack starts.
Create a Loopback by defining ISE as a "RADIUS Token Server" - you're telling ISE that there is a token server (which is itself … max up to 2 servers can be defined.
The RADIUS shared secret must be the same as the shared secret mentioned further below … it's not used anywhere else other than here (in the token server definition) and later on, in the ISE NAD definition.
Then use that ISE Loopback definition to modify the standard My Devices Sequence
Hilarious isn't it You have to create RADIUS Clients (NAD) definitions for each of the token servers (which in production would be most likely dedicated PSN nodes) - create a new Device TYPE called ISE_MyDevicesPortal (or whatever) and then use the same RADIUS shared secret as used before in the Token server definition.
I have some screenshots but they are taken from a customer setup -I have not sanitised them for this Community - but I think you should be ok with the information above.
The bottom line is that with this hack, The My Devices Portal will cause ISE to make RADIUS requests to ITSELF and you can catch these requests in the standard Policy Set.
Let me know how you get on
