Query specific AD group using certificate common name

[Antonio Macia]

Hello,

How can I check if an username retrieved from the certificate common name belongs to a specific AD group? In the policy set I can match against the general AD as an external group object (have a look at the attached screenshot) so ISE performs a lookup among all AD groups  but, is it possible to reference the exact AD group?

I need to create different authorization rules for my 802.1x wireless clients based on the AD group they belong to.

Regards.

[hslai]

If your ISE is of 2.x and fresh install, then there should be a Preloaded_Certificate_Profile with Use Identity From set to Subject - Common Name. If this is not there, you may create one with similar settings.

Then, select it for authentication and the AD group/attribute lookups in authorization will be using the common name field as the username.

BTW... I do not think your existing condition would work well as the AD external groups in ISE 1.3+ are represented in SIDs.

[Greg Gibbs · Accepted solution]

The CAP that Hsing mentions is how you identify what attribute in the certificate is used for identity (i.e. Common Name, etc). If you want to check that credential against your AD as part of the Authentication stage, you would also need to select your AD in the Identity Store dropdown box.

You can provide differentiated access for different AD user groups in the Authorisation Policy using the <AD>:ExternalGroups EQUALS <group> attribute.

-Regards

Greg

[Antonio Macia]

Thanks Gregory and hslai.

I was creating the AuthZ conditions from the Policy Set menu instead from the Library Conditions and couldn't find the group selection.