ISE API call to add user groups to Active Directory?

[Josh Morris]

I am trying to write a script that will search AD for group membership then add that group as a usable group in ISE so I can put it into policy. I am following these logical steps so far:

1) Get ID of domain (https://{{URL}}/ers/config/activedirectory)

2) Get SID of vendor group based on search (https://{{URL}}/ers/config/activedirectory/{id}/getGroupsByDomain) with the OU name in the body

3) Search current applied user groups to see if group exists

4) ???

The only call I can see in the API is to use the 'addGroups' call, but I'm having issues adding a new group with the name/SID. Any suggestions on this?

[Mike.Cifelli]

What version of ISE are you working with?

The only call I can see in the API is to use the 'addGroups' call, but I'm having issues adding a new group with the name/SID. Any suggestions on this?

-If possible, please share any related error output, code snippets, etc. that will allow the community to better assist.

[Josh Morris · Accepted solution]

I think I got it figured out. You can use the addGroups call in the following manner without all the additional values. I do get a 204 response here instead of 200, but the group shows up in ISE and can be used in policy. 

curl --location -g --request PUT 'https://ise.org.com:9060/ers/config/activedirectory/{id}/addGroups' \

--header 'Content-Type: application/json' \

--header 'Accept: application/json' \

--header 'Authorization: Basic XXX' \

--header 'Cookie: APPSESSIONID=XXX' \

--data-raw '{

  "ERSActiveDirectory" : {

    "id" : "{id}}",

    "name" : "{domain_name}",

    "description" : "",

    "domain" : "{domain_name}}",

    "enableDomainAllowedList" : true,

    "adgroups" : {

      "groups" : [ {

        "name" : "{full group path, can be seen in GUI under group name}",

        "sid" : "{path SID}",

        "type" : "GLOBAL"

      } ]

    }

  }

}'