How to fetch specific parameters from AD in ISE

[ImanMo93]

Hello everyone,

I was wondered if there any way to configure the fetched parameter from AD in Cisco ISE.

I have a problem in authorization.

The problem is, when I set Ethernet configuration to accept current user logon credential, it's gonna be something like this: Domain\UserName (SamAccountName), and when it comes to this, the ISE are unable to recognize the Group and Department of that user. But when I set Ethernet to ask users for their credential, everything is fine and gonna be something like: Username@Domain.

I also use Identity Rewrite to change the credential from SamAccountName to UPN but still have the problem.

So, I decided to add Department attribute to AD and LDAP but unfortunately ISE doesn't fetch that from AD.

That's why I started this discussion and asking for some help.

Any suggestion?

[Arne Bier · Accepted solution]

In the ISE Admin > Identity Management > External Identitie Sources > Active Directory, select one of the AD servers and click 'Test User'.  Check the AD attributes that ISE can retrieve, by supplying ISE with a valid AD username and password (if you don't supply a valid password then the attributes and groups cannot be listed)

Once you can see it here, then you know you can add this attribute into ISE for your AuthZ policies.

[ImanMo93]

Thanks Arne.

I use "MemberOf" attribute to AuthZ the clients.

Now It's successfully AuthZ users when they are Authenticated via NTLM.

[Colby LeMaire]

Just be careful with the "MemberOf" attribute for group membership.  It will list all groups that a computer/user is a member of EXCEPT the "Primary Group."  Normally, the "Primary Group" is Domain Users or Domain Computers.  I have seen in the past where the Primary Group is something else and that particular group does not show up in MemberOf.  You can test this by going to the properties on a user account and the group membership tab.  There is a button to set the Primary Group.  Set it to a group that you are checking for in ISE and see if it still works.  Instead of MemberOf, use the "Groups" tab in ISE and add the particular groups that you are interested in.