ISE 3.2 active directory authorization condition

[jcatanzaro]

Quick context - ISE 3.2 distributed deployment.  802.1x authentication policy sets have the following as our primary authZ policy for corporate machines:

The question I have is based on the external group condition.  Is ISE looking for a user certificate to pull the identity from and then validate via AD lookup?  Or is it somehow grabbing the windows session credentials instead?

Our machines get both machine and user certificates, because we're using the windows native supplicant we just match on the issuer to keep things simpler.  Not sure if that's even the right thing to do, but seems to mostly be working.

The reason I ask about how ISE gets the identity to validate against AD is because we're evaluating how we're deploying certificates and whether certain ones are needed or not.

[ahollifield]

It is pulling the username from the certificate.  Whatever is configured withing your Certificate Authentication Profile selected in the authc.

[jcatanzaro]

ok, so since we're set to "Any Subject or Alternative Name Attributes in the Certificate (for Active Directory Only)" it's taking any identity in the certificate (cn, san etc.) and checking it against AD.  That being the case, if the device presents a machine certificate, it shouldn't pass that rule because the machine would not be a member of domain users.

In most cases it does look like the machine is passing a user cert for this purpose.  However, we have the native supplicant set to "user or machine auth" which it seems like we should be restricting that to user auth since we get the machine validation from the intune check.

There are some cases where we need machine only, but those could probably be configured specifically for that.  Shared workstations on the factory floor as an example.

Is there any best practice doc for using the windows native supplicant?

[ahollifield]

Are we sure the machine use-case is actually occurring?  Or is actually hitting this rule and not a different one?

[jcatanzaro]

Yes, there are some machines hitting the machine only rules:

Most of them legitimately presenting machine certificates, some with user identities (contractors) which is something I need to figure out separate from all this.