Cisco ISE TACACS+ with RSA Securid and AD integration

[west33637]

I 'd like to use ISE with RSA AM and active directory as external Identity sources. But I would like to use RSA to authenticate users, and AD group membership to determine authorization policy. Is this possible?

How does this work? ISE will need to have the RSA AM configured as an external identity source in the authentication policy. where will ISE get the AD group info of the user in order to configure authorization policies against?

Does the RSA pass AD group information to ISE for the purpose of authorization?

[west33637]

I 'd like to use ISE with RSA AM and active directory as external Identity sources. But I would like to use RSA to authenticate users, and AD group membership to determine authorization policy. Is this possible?

How does this work? ISE will need to have the RSA AM configured as an external identity source in the authentication policy. where will ISE get the AD group info of the user in order to configure authorization policies against?

Does the RSA pass AD group information to ISE for the purpose of authorization?

[paul]

You don't need RSA to do anything other than say "Did the 2FA work or not?".  ISE authentication is completely separate from ISE authorization.  Define your RSA server to ISE and use it in the authentication phase to run the 2FA process.  Once the user passes the authentication phase the session continues to authorization.  In the authorization phase you can do whatever AD checks you want.

[west33637]

Hello Paul. Thanks for the response. I always thought that when a user session is authenticated against AD, AD returns the AD group information with the authentication passed message - and this group information was what ISE used in the authorization policy to determine how the user is authorized.

In a case where RSA is doing the authentication - are you saying that ISE will receive authentication passed message from RSA, and then still query AD for the users group information? I guess my question is how will ISE know what the user's AD group info is in order to apply authorization policy against it?

Thanks,

[paul · Accepted solution]

Nope that is now how AD authentication works. As I said authentication is separate than authorization. All the authentication phase is doing is answering the question "Are the credentials correct?". All the other look-ups happen in the authorization phase.



I am saying exactly what you summarized. RSA does pass/fail back to ISE and then in authorization ISE will do the AD look-ups.