ISE 2.2 One-Click Approval

[terdean]

Is there a way to utilize the schema options to map the email attribute to the UPN field? I have a customer that wants to use the one-click approval but the email attribute that is associated with the active directory user accounts are not being used. When they send emails out to users, they send it to the address within the UPN field.

[Jason Kunst]

I will check, pretty sure the answer is no

https://communities.cisco.com/docs/DOC-70777

What type of accounts are able to use the single click with token?

The sponsor email address must be populated under the AD or LDAP account Email.

ISE AD/LDAP schema is already mapped out of box when configured.

Administration > Identity Management > External Identity Sources > Active Directory > domain > Advanced Settings > Schema

[Jason Kunst · Accepted solution]

How about this, under the user info attributes put the UPN in for email, this will map your UPN to the email address field on ISE

[Thibault BRISSE]

Using a custom schema doesn't work......I've opened a case at Cisco few weeks ago, it should be an enhancement in the future.

I can't use use the one click feature because of that :

ENH: One-Click approval does not work with the "Only accounts assigned to this sponsor" option.

CSCvd29533

This enhancement is not expected in the first patch. For me it's a bug since I can't use this feature.

[Jason Kunst]

i checked with development and they said to try what I listed above

if not please list the bug you had for that

the other issues is known defect working with development on

[Thibault BRISSE]

I've just received the BUG ID for the schema : CSCvd85620. It may not be visible at this time but it should be soon.

Apparently, they've released the one click feature without try it :-).