Cisco ISE 8021x auth delay for macOS devices managed by Jamf Cloud.

[HamFisted]

A quick overview of the scenario: macOS devices are managed by Jamf Cloud. SCEP certificates are deployed from a Microsoft CA via the Jamf proxy. A custom sync workflow creates an AD object for each Jamf-managed device and ISE looks at the cert CN to perform a match to the AD object.

However, when automatic certificate renewal is enabled in Jamf Pro, a UUID is added to the CN of the deployed certificate so this authorization flow now fails. There are several SAN's in the certificate and when "Any Subject or Alternative Name Attributes in the Certificate (for Active Directory Only)" is enabled in the policy authentication is successful but with a significant delay. Is this delay to be expected?

[PSM]

@HamFisted Did you try using Certificate Attribute " Subject Alternative Name" ?

[Ben Weber]

The delay is caused by the 'Any Subject or Alternate Name Attributes in the Certificate', which forces ISE to parse all SAN attributes to match against AD. The length of delay will depend on the no. of SAN entries and/or the size of the AD forest.

You should be able to limit the no. of SAN entries in Jamf's SCEP configuration.