How to fetch info about users via the ERS API

Kamil Ciemniewski · ‎10-29-2019

Hello,

I'm trying to fetch the user's data for given endpoints via the ERS API by the device's MAC address.

As the first step I'm querying for the endpoint:

c GET https://<my-domain>:9060/ers/config/endpoint/<endpoint-id> Content-Type:"application/json" Accept:"application/json" --user "<user>:<password>" | bat -l json

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, must-revalidate
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: JSESSIONIDSSO=<...>; Path=/; Secure; HttpOnly
Set-Cookie: APPSESSIONID=<...>; Path=/ers; Secure; HttpOnly
Pragma: no-cache
ETag: "<...>"
Date: Tue, 29 Oct 2019 13:21:40 GMT
Content-Type: application/json;charset=utf-8
Content-Length: 697
Server:

   1   │ {
   2   │   "ERSEndPoint" : {
   3   │     "id" : "<id>",
   4   │     "name" : "<mac>",
   5   │     "description" : "TEST -work laptop",
   6   │     "mac" : "<mac>",
   7   │     "profileId" : "<profile-id>",
   8   │     "staticProfileAssignment" : false,
   9   │     "groupId" : "<group-id>",
  10   │     "staticGroupAssignment" : true,
  11   │     "portalUser" : "<user-name>",
  12   │     "identityStore" : "",
  13   │     "identityStoreId" : "<identity-store-id>"
  19   │   }
  20   │ }

This gives me the "portalUser" and "profileId" but there doesn't seem to be any way to get the data I can see about this user when I log into the Cisco ISE admin in the browser. I can e. g. see the first and last names of the user in there but not in the API. I've tried different ERS API routes - internalusers, guestusers etc but the user was simply not there.

Could anyone please shed some light on what can be done with the "profileId" and where can I potentially look for the info about users?

Thank you,

Kamil

howon · ‎10-30-2019

profileId: It would be ID of profiling policy applied to the endpoint. You will need to use another API call to find out the readable profiling policy name that matches the profileId

portalUser: If the user was authenticated via external means such as AD, LDAP, SAML, etc then you would need to look up the external identity store for the user name mapped to MAC address