ISE CWA with AD Authentication

[Will Kerr]

Hey Guys,

I'm trying to configure a CWA that will only pass web auth if you login with a certain AD group.   I’m pretty sure you set the authentication for a CWA via an ISS on the portal configuration.  With an ISS you can’t lock it down to a specific group, and by the time they pass the web authentication I don’t think I could have them fail via an authz policy that references an AD group. 

Any help on making this work appreciated.

Thanks,

Will

[nspasov · Accepted solution]

Hi Will-

To answer your question: You control the actual access in your authorization policies. For instance, you can configure the policies where:

1. 1) If user is part of internal ISE guest users then they get Intenret Only
2. 2) If user is part of external AD group “Contractors” they get Internet+Some Internal access
3. 3) If user is part of external AD group “Domain Users” then they get Internet Only+Access to Intranet site

You would control the actual access via Named ACLs in the WLCs that are then referenced in your Authorization Policies.

Thank you for rating helpful posts!