Identity Stores, Active Directory and LDAP

What it is

An identity store is the place where ISE looks up a user or machine to check who it is.

ISE can keep identities itself, or ask an external source. The external source is often Active Directory, but it can be an LDAP directory, a certificate authority, or a token server.

How it works

ISE joins or connects to each store, then policy decides which store to ask and which attributes to use.

Native Active Directory

Native means ISE joins the domain as a member machine. The Policy Service Nodes then talk to the domain controllers directly.

Before you join, check three things:

• DNS: ISE must resolve the domain and find the domain controllers.
• Time: The ISE clock must be close to the domain controllers, because Kerberos is sensitive to time.
• Account: The account you use to join needs the right to create or use a computer account.

The join is done in the admin portal under Administration, Identity Management, External Identity Sources, Active Directory. You add a join point, enter the domain, and join the nodes. Each node shows a status of Operational when it is joined and healthy.

After the join, open the Groups tab and select the directory groups you want to use in policy. Only the groups you add are available as conditions. The Attributes tab works the same way for directory attributes.

ise-psn/admin# show application status ise
ise-psn/admin# show ntp

Use show ntp on the ISE command line to confirm time sync before a join. A join that fails after a correct password is often a clock or DNS problem.

AD supports the common password based and certificate based methods. That includes PEAP with MS-CHAPv2 and EAP-TLS. It also supports machine authentication, where the computer account is checked as well as the user.

LDAP

LDAP is a generic directory connection. You use it for non Microsoft directories, or when you do not want to join the domain. It is configured under External Identity Sources, LDAP.

You enter the server name and port, the bind account, and the search bases for subjects and groups. For a protected connection, use LDAPS, which runs on port 636. Plain LDAP uses port 389.

LDAP cannot check an MS-CHAPv2 password, because the directory does not give ISE the secret it needs. Use PAP over a protected tunnel, or use certificates, with LDAP.

Other identity store types

ISE supports more sources than AD and LDAP:

• Certificate authentication profile: Used for PKI. It picks which certificate field is the username, and can compare the certificate with the directory.
• RADIUS token server and RSA SecurID: Used for one time passwords.
• SAML identity provider: Used for portal sign on with an external provider.
• ODBC: Used to look up users in a database.
• Internal users: A local database inside ISE, good for small groups and test accounts.

Internal endpoints are a separate local store. ISE keeps endpoint MAC addresses there, and policy can use it for MAB.

REST ID store

A REST ID store lets ISE check users against a cloud identity provider through its web API, with no domain join. The usual example is Microsoft Entra ID, formerly Azure Active Directory (Azure AD).

ISE uses the OAuth 2.0 Resource Owner Password Credentials (ROPC) flow. It sends the username and password it received to the provider and gets back a token. ISE can then also read the user's groups for use in policy.

Because ISE must pass the user's password on to the provider, it needs an authentication method in which it can see the real password.

Multifactor authentication

Multifactor means a password plus something else, such as a one time code or a push. ISE does this by pointing at a token server, an external multifactor service that acts as a RADIUS proxy, or a SAML provider.

The usual design is that ISE sends the request on and the external service handles the second factor. ISE then acts on the result.

Identity source sequences

A sequence is an ordered list of stores. ISE tries them in order until one finds the user.

You use a sequence when users could be in more than one place. You can also say what to do if a store cannot be reached: stop, or move on to the next one.