cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3996
Views
0
Helpful
3
Replies

ISE not pulling all identity attributes from AD.

jahamilton1
Level 1
Level 1

I'm trying to use the device group condition to create an authorization policy based on user attributes from the AD.

It didn't work out and also got this from the report.

geo_code 24100.JPG

Code 24100 seems to be the problem. Cause I have deployed similar policy for another client and code 24100 seems to be the only strange report I can see.

Thanks.

1 Accepted Solution

Accepted Solutions

hslai
Cisco Employee
Cisco Employee

The error implies the attribute is empty. If your AD test is done with the same user, are you seeing it differently?

For example, I configured an authz profile to return the attribute "mail" from AD. It does NOT give 24100 when the AD user has non-empty value for this attribute; whereas it gives 24100 for an user not configured for this attribute.

Screen Shot 2017-03-30 at 8.32.25 PM.png

Screen Shot 2017-03-30 at 8.41.11 PM.png

View solution in original post

3 Replies 3

Oliver Laue
Level 4
Level 4

did you see these attributes on the client if you use the AD test tool on external identity sources?

Yes I do. All required required attributes were pulled when I did a test

tool.

hslai
Cisco Employee
Cisco Employee

The error implies the attribute is empty. If your AD test is done with the same user, are you seeing it differently?

For example, I configured an authz profile to return the attribute "mail" from AD. It does NOT give 24100 when the AD user has non-empty value for this attribute; whereas it gives 24100 for an user not configured for this attribute.

Screen Shot 2017-03-30 at 8.32.25 PM.png

Screen Shot 2017-03-30 at 8.41.11 PM.png