Cisco Device admin policy set using RSA as external ID source

[stuartcross]

Trying to configure a device admin policy set for TACACS plus, using RSA to authenticate.  I can get the Authentication to work and I see ISE talking to RSA in the tacacs logs and authenticating ok, however the authorization fails and says there is no user in the selected identity store.  How can I configure the authorization part of the policy?

Thanks

[poongarg]

Kindly download the complete report for working and non-working scenario and attach it as just screenshots of the report will not help much. Also attach the complete authentication and authorization policy details for matching policy.

[stuartcross]

Hi, The tacacs reports do not give you any detailed information.  Only a CSV outlining the attempts and if they failed or passed.  Is there a way I can download the the detailed report?

[stuartcross]

Also, just to add, this does not happen if I use AD as the external ID source. Only when using RSA, so maybe a symptom of using RSA as the external ID source, as it doesn't share the username with ISE, unlike AD?

[poongarg]

You need to press CTRL+P to print the report. Also need to see the AuthC and AuthZ policies configured for this authentication.

[stuartcross]

Hi, I'm slightly uncomfortable about posting our policy on a public forum, is there a more secure method?

[poongarg · Accepted solution]

Try to enable the user cache under RSA config and let us know the result . Suspecting that it could be below issue as well:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz88188

But till the time runtime, nsf and nsf-session debug logs are not seen, cannot confirm.

[stuartcross]

Do you mean identity caching under RSA_Secure ID Identity source?

[poongarg]

Yes, that's right.

[stuartcross]

Thankyou for your time on this. Changing this setting has allowed to me successfully log onto a Cisco device now using RSA, without needing to use the advanced "continue" if user not found option! Many thanks.