Authorization rule to match both AD OU and Group

[Madura Malwatte]

We have a AD domain added to ISE with two sub-organizations, say orgA and orgB - these are the two OU's. We want to use ISE to match computer objects from only a single OU (orgB). So for example we have Domain Computers AD group, but the objects in this group are either in orgA or orgB, and we only want to match ones from orgB. Would my authorization policy condition be something like this:

if:

AD1:DistinguishedName MATCHES .*(ou=orgB).* AND

AD1:ExternalGroups EQUALS AD1/Users/Domain Computers

then: PermitAccess

Basically orgA objects should not be authorized by ISE, only orgB. There was another discussion here saying "not recommended to use OU, which is not indexed, so would result in poorer performance" Is there an alternative way to make this work without performance hit? How bad would the poorer performance be?

[Francesco Molino · Accepted solution]

Hi

Using not indexed attributes can have really bad performance but it depends on your AD.
Take a look on the following Cisco Live presentation: https://www.ciscolive.com/c/dam/r/ciscolive/apjc/docs/2019/pdf/BRKSEC-3432.pdf
Look at page 176, you have links explaining which attributes are indexed and how to index them.

Also, you have 2 domains but do you want to use always only 1 domain and not the other? If so White list domain can help without using specific attributes.

The other thing is that you can have multiple domain and add groups based on domains. Groups will have the domain name as prefix and you will be able to select the correct one in your rules (ISE uses the SID and not the name itself).

[Madura Malwatte]

Hi Francesco thanks for the reply. Just to clarify its actually just one domain and the different orgs sit under their own OU. So whitelist domain wont help. 

If I understand correctly we can use OU distinguished name attribute IF this attribute has been indexed on AD side? Once indexed it won't cause any performance issue on ISE correct?

[Francesco Molino]

Never had to deal with your same requirements but used some specific attributes indexed and didn't experience any performance issue.

In this area the ad architecture is important anyway like which domain server to authenticate when on multi site architecture and this is managed on your AD. I believe this is well explained on the Cisco Live pdf.

[craig.beck]

Using "Domain Computers" isn't something I'd do if you're using simple OUs to separate resources on the domain. You should probably be using specific AD security groups for each sub-org. That will make policy configuration simple.

[Madura Malwatte]

Okay but if I had to do it this way. Is the matching statement for distinguished name correct that I have here?

AD1:DistinguishedName MATCHES .*(ou=orgB).* 

[craig.beck]

I've not tested it, but yes it looks like the Regex would work with a minor tweak. You'll need to be case-sensitive with the expression, so:

.*(OU=orgB).*

You'd might want tighten up the Regex though to ensure it matches the exact OU and that it can't be abused via other OUs being created in AD. If you look at what a current user/computer's DN looks like via ISE's AD Attributes page you can pull the rest of the string to put in the Regex. In my lab it's:

CN=labuser,OU=Lab,DC=lab,DC=local

So my Regex would be:

(CN=).*(OU=Lab,DC=lab,DC=local)$