I need advise of how to merge Authorization Profiles in a Policy Set.

[Amen]

We have a need to merge Authorization Profiles in a Policy Set. By default, ISE will select the first match for a RADIUS attribute and will not combine any other matches that contains that attribute. Only single statements with multiple Authorization Policies as the result are combined.

For example, if I have the following conditions, only the “Allow123” result is sent and the “AllowXYZ” result is ignored:

Condition: AD=Group123, Attribute: EfficientIP:EfficientIP-Groups = Allow123
Condition: AD=GroupXYZ, Attribute: EfficientIP:EfficientIP-Groups = AllowXYZ

We need to find a way to merge the resulting attribute values, while maintaining the 1-to-1 relationship from AD group to Profile mapping, so that the result is:

EfficientIP:EfficientIP-Groups = Allow123,AllowXYZ

A single statement with multiple Authorization Policies does not work for this requirement as there is no way to keep the AD Group to attribute relationship.

Thanks for you in advance

[Torbjørn]

The way to go about this is to maintain one authorization profile per group you wish to authorize, mapped to a single result. If i am interpreting your post correctly, you are running into a situation where a user is both the member of group Group123 and GroupXYZ? If so you will need to prioritise one over the other, unless you can filter based on a secondary AD attribute as well. 

[Amen]

Prioritization doesn’t work for this situation, because I need multiple results to be merged as the user is a member of multiple EfficientIP groups that have different security access.

If we use prioritization, the users only have partial access to what they need access to in EfficientIP.

[thomas]

I don't understand what an EfficientIP group is but you may return multiple ISE Authorization Profiles per authorization rule.

Duplicate attributes are allowed by the RADIUS protocol but how they are interpreted by the network device (first wins vs last wins) is implementation dependent. Test carefully - your mileage may vary.

[MHM Cisco World]

the Condition is like IF and profile like THEN

then can not be two profile 
why you not use new AD profile and result is one authz profile ?

MHM