ISE 1.3 Patch 2 ERS API and Child Identitygroups

[geir.hakon.svendsen]

Hi

I am trying to list all user identitygroups with an ERS API Call
https://<ise-pap>:9060/ers/config/identitygroup?page=1&size=100
Accept-Header: application/vnd.com.cisco.ise.identity.identitygroup.1.0+xml

This lists all Top Identitygroups, but not my child identitygroups.

I tried to filter my request to include only groups that starts with A_

https://<ise-pap>:9060/ers/config/identitygroup?page=1&size=100&filter=name.STARTSW.A_
Accept-Header: application/vnd.com.cisco.ise.identity.identitygroup.1.0+xml

 

But my result lists only A_Top_Group

What am I doing wrong ?

[jan.nielsen]

Have you tried without the paging and the filter, is the result the same? Your request looks ok to me, it should return all groups, i don't see any other way of getting the identity groups from the API

[geir.hakon.svendsen]

Yes, I have tried without paging and filter, and the result is the same, all top groups are returned, but child groups are missing.

[jan.nielsen]

I have a non patched 1.3 and a 1.4 ise in my lab, i'll try it when i get back in the lab tonight and see if versions/patches make any difference

[jan.nielsen]

Hmm, i only had an ISE 1.4 running at the moment to test, and the problem is the same, only the "root" level of groups get sent as a result of the lookup in the API, don't know if it's an actual bug, but it sure seems like its the same across versions

[geir.hakon.svendsen]

Thank you for testing this out in your ISE 1.4 lab. I will proceed to create an TAC Case to figure out if this is a bug or not.

I will update this post when I got an answer from TAC.

Thanks again.

[geir.hakon.svendsen]

I got an answer from TAC today

Indeed, that is not working as you have explained. I have tested that in ISE 1.3 and ISE 1.4 with same results.
While behaviour is unexpected I have opened a bug: CSCuv73308 "ISE 1.3/1.4 REST API not returning "child" identity groups"

[jan.nielsen]

Thanks for the info, i will be tracking the bug.