Could you share sanitized "show run all aaa server"    Ensure that you have selected protocol ldap, vs what it may set as default "radius" 

You can do this with LDAP attribute mapping on Cisco Firewalls:    But depending on what type of Radius server you are using you should be able to pass back attributes as well. Several methods to do this depending upon your topology.    Guide is here...

This really could be a multitude of issues: Being as you are on ise 2.2 there have been quite a few fixes that addressed this:    You will most likely want to see the Live Logs report for the authentication attempt: If this does not garner additional...

There are some compatibility issues with certain keys:    This document will give you the compatibility and is pretty good with giving you an idea of a scope of using this:    We have customers who use Yubikey, most recently worked with a customer wh...