ISE unexpectedly queries AD from AuthZ policy

[Andrii Oliinyk]

Hi Guys

i have subject in 2.1 latest patch cube. aaatest'er gets successfully authenticated against internal identities store only. but within AuthZ-policy it unexpectedly queries AD which shouldnt ever happen from my pov. or did i miss something?

  

[Arne Bier]

Hi @Andrii Oliinyk 

You need to show us your Authorization Policy - if there is reference to an AD Group lookup, then of course it will query AD.

[Andrii Oliinyk]

hi Arne

AuthZ policy is in the top of screenshot in the end of my initial msg. It refers to internaluser.name &device type only

[Arne Bier]

Oh yes of course - pre-ISE 2.3 - forgotten how that looked. You're right - there should not have been any AD involved.

Are you sure that you hit that "Switch AAA Test" and not something else (before, or after that Policy?)

[Andrii Oliinyk]

Hi Arne

absolutely sure. u can see from screenshot "15004 Matched rule - Switch AAA test " & there r no others similar