FMC AD integration

[peter.matuska1]

hello,

I configured the FMC <-> AD integration for policy creation purposes. The FMC now sees the users from AD. The problem is that according to my research it grab the samAccountName from the user object. Is it possible to change it? I need the user in an UPN format. I saw that it is possible for admin access but what about the policy purposes?

thank you

[balaji.bandi]

As far as I know, it's not possible as of 7.6.x (But I'm happy to hear if any other member has experienced it differently)

[peter.matuska1]

very nice. ok and how to solve this scenario: Users have certificates where UPN is used in template. When I use only cert authentication the UPN doesnt match the downloaded samaccountname so ACP based on AD group is not matched and the user is denied from the network. So I cannot change the samaacountname to UPN in FMC, I cannot use samaccountname instead of UPN in the MS CA template. How to solve this without making changes on users? thank you

[balaji.bandi]

Maybe I should look to use ISE to solve the issue; worth checking this post :

https://community.cisco.com/t5/network-access-control/cisco-ise-ad-authentication-based-on-upn-only-instead-of-upn/td-p/3356569