Is it possible to use ISE for authorization without authentication? My use case centers around using ISE to authorize SSLVPN connections in an SSO configuration, without having to supply credentials for authentication. In this use case we would validate a user certificate on an ASA, and if it's accepted the ASA would pass the username over to ISE for group membership lookup in AD. Based on the group memberships that are returned from AD, ISE would send back authorization permissions to the ASA.
Thank you! This was helpful, but do you know if there is a way to pass back a name from the certificate itself, like UPN or CN, and look that up in AD to get group membership(s) to determine which authorization policy to apply?
