Prevent ISE from sending authentication to AD if BadPwdCount = <value>

[scott.stapleton]

I'd like to configure ISE so that if the AD attribute badPwdCount is equal or less than a particular value, ISE won't send any additional authentication attempts in order to prevent ISE from locking out the AD account. This is for CWA that is hooked into AD. Yes, it's a bad idea to use a CP with an AD back-end but alas, that is the task I have at hand!

As far as I know and can see, ISE only supports AD attribute use with the AuthZ policy, not AuthN and therefore this capability is NOT support by ISE but perhaps I am missing something. Can anyone confirm definitively?

[Timothy Abbott · Accepted solution]

AD attributes are only available for use in authorization policy.  ISE will still query AD if the authentication request comes in regardless of the attribute.

Regards,

-Tim

[scott.stapleton]

Cheers - that's inline with documentation and my testing.

[howon]

If using CWA there is better option. We have authentication rate limiting directly on the portal page that you can use. This isn't utilizing AuthZ policy:

[scott.stapleton]

Cheers. Unfortunately this is a much worse option. I've already tested this option but as ISE doesn't know the BadPwdCount in AD, in many case the AD account will be locked out. For example, if BadPwdCount is already at 2 because it was tripped by some other application that hooks into AD or standard Windows login where the the user makes a typo twice (and AD policy is 3 failed logins), ISE will still send request not knowing AD is at 2, and lock it out.

[Jason Kunst]

Not sure what you expect from us thought? Sounds like a feature request? Or change the value to 10?