Looking for some input on a use case we’re attempting configure.
Use Case:
Auth device via endpoint cert = permit and redirect to IdP for user auth
User auth successful = permit and apply dacl per AD group mapping
Problem: IdP is home grown, only able to pass back the user ID and email address in the assertion
Question: Understanding passive ID has a restriction of CWA not being supported, since we are doing machine auth via the certificate, are we able to do the following:
Auth Z
Use case = guest flow = permit (reauth occurs) - COA reauth result
CWA auth’d & posture unknown = posture
Posture=compliant & passiveid=ad group x then dacl
Machine in AD group X = permit, redirect to SSO for auth
