Best Practices for using ISE Authorization across multiple domains

[asdraper]

I have recently found that the way our ISE was set up, we have one Active Directory Join Point, pointing to a global catalog server so that we can authenticate users across multiple domains with trusts.  Now, we have users with active accounts in these external domains who need to have disabled accounts in our primary domain for email purposes, and so the ISE authorization finds the disabled account in the primary domain and stops looking for the active accounts in the external domains.  It sounds like the only way to work around this is to create multiple join points, then add them separately to the Identity Source Sequence with the primary domain as the last resort.  Would that be best practice?  I have all of these AuthZ requests coming from a single VPN tunnel, so I don't think I could create individual rules for each domain, I have to keep them in one rule with an appropriately ordered Identity Source Sequence.  

[MHM Cisco World]

Authc can use one or multi identity source 

in Authz you can specify AD group

MHM

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/215432-configure-ssl-anyconnect-with-ise-authen.html

example 

MHM

[asdraper]

Our AuthC is happening on the ASA, then passed to ISE for AuthZ.  I have the Identity groups built with rules associated with them.  The issue is it appears that the disabled user account is being found first and it fails the Authorization as being disabled.  I think I have to split the join points and create them as multiple steps in the Identity Source Sequence.  If I take a test user and remove their disabled account from my primary domain, everything works perfectly.  As soon as that account is allowed to replicate, all logins fail because ISE finds the disabled account first.  

[MHM Cisco World]

Can I see tunnel group of ASA ?

MHM

[asdraper]

I misspoke a bit earlier. The AuthC is actually passed from the ASA to Duo, then when the user account passes AuthC then the ASA is set to hand it off to ISE for AuthZ.  

[thomas]

Yes, multiple join points is the answer.

This is why they are called "join points" and not simply "domain connections" - because you may join one or more domains in any way necessary up to 50 times to workaround whatever crazy AD environments that you cannot change.

[asdraper]

Understood - I am cleaning up the setup that a vendor did for us years back and I suspected as much.  They made one join point and added the Domain Users group so everyone got swept up into one big rule.  I am attempting to break it all apart again.  

So then would the best practice be, even with domain trusts in place, to set up several join points, then put them all separately into the Identity Source Sequence?  Luckily in our case I believe all these disabled accounts would only be in our primary domain, so I would make that last in the sequence and hope they get picked up in their primary domains first?  The initial thought was that we were excluding some OUs by adding them as groups (and not others), but I see now that is not the case.