How do I authenticate users in a specific AD group with Cisco ISE

[Christopher Stuewe]

I have ISE up and running authenticating properly.  But right now it will authenticate and allow ANY account in Active Directory.  I want to allow access to only users in a specific group in Active Directory.  I have added the group under Administration>Identity Management>External Identity Sources>Active Directory>Groups.  But, I have not been able to find a way to link membership in that group to the Authentication Policy rules.

[Tarik Admani]

Hi,

You will have to add the group in you AD settings.

Then you can map that group in you authorization profile.

Thanks


Sent from Cisco Technical Support Android App

[Christopher Stuewe]

Yes, I understand that.  I have added the group in AD settings. 

What I need to know is HOW do I map that group to the auth profile?

[Tarik Admani · Accepted solution]

Under your Authorization policy, when you add the condition, choose the advanced option, there you should see an option for AD (select that) then the ExternalGroup option should appear. Set that attribute option equal to the AD group you are after.

Thanks,

Tarik Admani
*Please rate helpful posts*

[Christopher Stuewe]

Thanks for the reply.

I'm not getting AD as an option (see below).  Any idea why that might be?

[Tarik Admani · Accepted solution]

Chris,

I dont know where you are with the screenshot but follow this path:Policy > Authorization > (on the rule you want to limit AD group access) Select Attribute > Create New attribute (Advanced) the AD option should appear there. Currently the box i am using isnt joined to AD so I can't show you how it looks.

Thanks,

Tarik Admani
*Please rate helpful posts*

[Christopher Stuewe]

Thank you very much.  That was the step I was missing.  It works the way I want it to now.

[Christopher Stuewe]

Disregard above.  I was looking in Authentication not Authorization rules. 

[manjeets]

Kindly review the below link:

https://www.cisco.com/en/US/docs/solutions/Enterprise/Security/TrustSec_2.0/trustsec_2.0_dig.pdf