ISE 3.2 and AzureAD - groups retrieve

[pio.gra]

Hi,

I'm trying to connect ISE 3.2 to AzureAD, the connection itself worked fine (following the guide: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/216182-configure-ise-3-0-rest-id-with-azure-act.html) but now I'm not able to read any AD groups. After clicking on "Retrieve groups" it tries for few minutes and then it says "No Data Found". 

The other question - is it possible to read extended attributes from the AzureAD accounts?

[thomas]

These are the required permissions that I have used successfully with AzureAD for both scenarios :
- EAP-TTLS+PAP username+password authentication+authorization using in ISE 3.0+
- EAP-TLS (or TEAP) user certificate authentication with AzureAD group authorization in ISE 3.2+

[Rodrigo Diaz]

@pio.gra  try to check out the ropc .log, this can provide you a view of what could be missing/failing within your configuration , this can be seen in the PAN node via CLI with the command  "show logging application ropc/ropc.log (tail) ", what I would recommend here is to tail the process in real time while attempting to retrieve the groups and also taking a pcap to ISE so you can get further insight on what's happening .

[pio.gra]

@thomas I have it configured exactly the same way but no success unfortunately.

@Rodrigo Diaz I'm not able to read the logs for some reason, I have tried with the command you gave and get no output. Via GUI I can see the following:

but I'm not able to download any of the files. Or maybe I'm doing something wrong?

[Rodrigo Diaz]

@pio.gra  please share what you are getting in the CLI , you can attempt the command "show logging application | i ropc ", for further details of what you might expect to see refer to the section "working with logs" from the following link https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/216182-configure-ise-3-0-rest-id-with-azure-act.html in case you don't get outputs like those or even errors , it may indicate some configurations within your setup are missing . 

Let me know if that helped 

[thomas]

I have experienced the same bug in ISE 3.2 trying to download the log file.

Verify that you have entered the correct Username Suffix for your Azure AD domain, beginning with the required '@' symbol. For example, my Azure AD Username Suffix in ISE is @trust0.onmicrosoft.com

You should be able to see this on the Overview page in Azure AD:

[pio.gra]

@Rodrigo Diaz - it's a very good catch, I was trying with the wrong path:

admin#show logging application | include ropc
48077 Nov 17 2022 16:18:22 ropc/rest-id-store.log
438141 Nov 14 2022 13:10:56 ropc/rest-id-store.log.2022-11-14-1

so when I tried with: admin#show logging application ropc/rest-id-store.log

it showed the output and the issue I see at the first sight is: The user account {EmailHidden} does not exist in the {hidden} directory. To sign into this application, the account must be added to the directory.

Is it an AD thing or should I configure something more in ISE?

[Rodrigo Diaz · Accepted solution]

@pio.gra  I have checked your log , I would double check up the tenant and the AD that you are using in the integration  , it also likely that you might be hitting the following bug  CSCwd78306 as per the version in which you are which is 3.2 , in that scenario if it's possible for you test that out in another version of ISE while this bug is solved. 

[pio.gra]

@thomas - I have checked that and it is configured properly, the issue is that ISE is not able to communicate with the AD, see the above post.

[thomas]

Do you know approximately how many Azure AD groups your domain has? I believe the REST ID Store was only tested with <=5000 groups in Azure AD so if you have significantly more, it may be timing out without downloading all of the groups

[pio.gra]

@thomas - not sure about the groups, but I believe it will be less than 5000, will check it

@Rodrigo Diaz - that bug looks interesting and it's most likely it Is there any other way to integrate ISE and AzureAD? We have more and more devices migrated and it's now crucial for me to include those in all the policies... I'm currently using ISE 2.6 in the production, wanted to implement 3.2 because of the native cloud support (I need to have some nodes in the Azure cloud), and the AzureAD integration of course.

[Rodrigo Diaz]

Unfortunately this is the only way to achieve the integration with the AzureAD.

It would appear that the bug is going to be solved in patch 1 for this version that has a tentative date to be released in next Month , in any case what I would advise you is to either wait for the patch 1 to be available and test out the integration again or if it's urgent to get this deployment working in 3.2 to open a TAC case to get a hotfix patch. 

[pio.gra]

@Rodrigo Diaz - thanks for all the information, do you know if 3.1 is also affected? Maybe I could install the older version just to be able to work on testing the policies etc... before the bug is fixed.

[Rodrigo Diaz]

Yes you can try out another 3.X version to review if you are getting the same result , as per the bug conditions it has not been documented other versions affected. 

[pio.gra · Accepted solution]

If anyone has the same issue - it is now fixed in Patch 1.