ISE as authorization server, but Identity source is AD

[yongwli]

Hi Experts,

Customer has a requirement, can we do it with ISE?

User A is one of AD user, User A connect Anyconnect VPN and authenticated by ISE with AD identity source. After authentication, ISE assign VPN group policy to ASA. Custome would ISE have a user list, only user in the list can have higher VPN network privilege because the AD dont have any attribute for reference.

I know ISE could define condition with user=A or user=B or user=C, but is there any better way to do it?

Thanks

DL

[Surendra]

Why not add those users to a custom group on the AD and use that AD group in the authorization policy?

[yongwli]

Customer is network administration team, they cannot get AD team support to do it. So ask us this question, it's presale question.

[Surendra · Accepted solution]

Use shadow users.

Configure a user identity group on the ISE.
Configure the users which are highly privileged on the ISE and while configuring them, choose the password store as Active Directory instead of configuring the passwords locally on the ISE for those users.
Configure an authorization policy with the ISE internal user group condition to assign the required group policy.
In the authentication policy, make sure that internal identity store is looked at first and then the AD join points (create a new identity source sequence if required).

I haven’t personally tried this but logically speaking, this should work.

[yongwli]

thank you, let me have a try.