allow GUI access to ISE 3.0 to particular user from AD group

[shrijan]

Hello Everyone,

is it possible to allow particular user from AD group to have access to GUI ISE?

thanks.

Regards,

shrijan 

[marce1000]

 - FYI : https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200891-Understanding-Admin-Access-and-RBAC-Poli.html#anc15

 M.

[Greg Gibbs · Accepted solution]

It sounds like you are wanting to limit admin access to ISE to just a single user within an AD Group. I don't believe there is a way to do this without ISE pointing to another external RADIUS server (as a RADIUS Token server), creating a 'shadow' admin account in ISE, having the external RADIUS server doing the authentication, and ISE doing the authorisation.

It does not appear that you can use the External shadow user account to authenticate against AD, only for RSA and RADIUS Token servers.

It would be a much better option to create a new AD Security Group for this admin account and mapping that to the Super Admins RBAC Group.

Another option would be to create a local admin account for that user, but then you would need to manage the password lifecycle directly via ISE.

[shrijan]

@Greg Gibbs 

i think "It would be a much better option to create a new AD Security Group for this admin account and mapping that to the Super Admins RBAC Group", this option is suitable. Because if there is new staff comes up and needs to give him admin access then just add his account to new AD Security Group. And also to remove him from the admin access in future, just by removing him from this new AD Security Group is easier.

Thanks.