ISE Authentcation via Active Directory based on SSID and AD Group

Hi,
I am deploying ISE with WLC 7.4. I have two SSID(s) running in my network 1. Corporate & 2. Services. I have a domain setup lets say "AD.com" with 4 groups 1. Corporate, 2. Services, 3. Employees, 4. Contractors.
Here is an example of the scenario that I want:
AD.com Group : Corporate's User : 1. C_USER1
                                                    2. C_USER2
                                                    3. C_USER3
                                                    4. C_USER4
                                                    5. C_USER5
AD.com Group : Services's User :   1. S_USER1
                                                    2. S_USER2
                                                    3. S_USER3
                                                    4. S_USER4
                                                    5. S_USER5
Now what I want to do is have 802.1x authentication on my Corporate SSID that will check in AD.com, ONLY AND in ONLY corporate group for authentication. That is only C_USER1 to C_USER5 are allowed to connect to it. Users from any other AD group shouldnt be authenticated on this SSID.
The same for the services group & SSID.
Thanks.
Usama

Kindly review:
https://www.cisco.com/en/US/docs/solutions/Enterprise/Security/TrustSec_2.0/trustsec_2.0_dig.pdf

Similar Messages

I have a task, that is i want to retrive the details from active directory based on name and i want show that details into grid view.

Hi All,
I have a task, that is i want to retrive the details from active directory based on name and i want show that details into grid view.
Can any one help how to start.
Thanks in advance!

Hi AnilKarthik,
You can get user details by name using DirectoryService namespace. Then you can create a DataTable to restore the information and then bind to the SharePoint GridView.
Here are some deatiled code demos for your reference:
how to get userdetails from Active Directory based on username using asp.net:
http://www.aspdotnet-suresh.com/2011/03/how-to-get-userdetails-from-active.html
How to get User Data from the Active Directory:
http://www.codeproject.com/Articles/6778/How-to-get-User-Data-from-the-Active-Directory
Using SPGridView to bound to list data in SharePoint:
http://nishantrana.me/2009/03/23/using-spgridview-to-bound-to-list-data-in-sharepoint/
Best Regards
Zhengyu Guo
TechNet Community Support

How to setup Wireless Clients MAC+Active Directory based acess

Dear Gents,
I want to setup Wireless Clients MAC+Active Directory based acess on AP 1242 standalone Wireless series .
Steps i have configured :
1) SSID manger under Open authentication : Selected with EAP.
2) under advacned Radius : s
MAC Address Authentication
MAC Addresses Authenticated by:
Authentication Server Only
3) Server Manger : Current server list
added the radius ip address 10.1.200.x
EAP Authentication
MAC Authentication
Accounting
Priority 1: < NONE >10.113.253.1010.1.200.23410.8.200.1510.15.200.15
Priority 1: < NONE >10.113.253.1010.1.200.23410.8.200.1510.15.200.15
Priority 1: < NONE >10.113.253.1010.1.200.23410.8.200.1510.15.200.15
Priority 2: < NONE >10.113.253.1010.1.200.23410.8.200.1510.15.200.15
Priority 2: < NONE >10.113.253.1010.1.200.23410.8.200.1510.15.200.15
Priority 2: < NONE >10.113.253.1010.1.200.23410.8.200.1510.15.200.15
Priority 3: < NONE >10.113.253.1010.1.200.23410.8.200.1510.15.200.15
Priority 3: < NONE >10.113.253.1010.1.200.23410.8.200.1510.15.200.15
Priority 3: < NONE >10.113.253.1010.1.200.23410.8.200.1510.15.200.15
From ACS - Radius we have choose a Group x( named as Mac-address group )
All the wireless Client ( laptops ) mac-address are added as add username option and enter username
as mac-address & enter the mac-address as pwd second option of password TAB.

Hi Akber,
I think you didnt understood what i was trying to say here :-( No problem..I will explain my theory again.Your requirment is to autheticate user from ACS internal database (you have already added the MAC address as the username on your ACS internal database) as well as from ACS external database (in your case this is AD).
What i was saying is when when authetication request comes to raidus server it checks its internal database and if it find a valid username and password (here it will the MAC address and password which you have entered to the ACS database) the ACS will not query the external database (in your case the AD) for authetication.
You can not have ACS to look in to both MAC and AD database at the same time.
Hope this clears your doubt.
Regards
Najaf

Powershell script to Scan Active Directory Attributes for Country and Department ,Then add to Sales Group then add to Distribution list based on Region

Hey Scripting Guys,
I have been in and out of Powershell last few years, not that great at it tbh !!! I'm looking for advice on how I can as in Title, Create a Powershell script to Scan Active Directory Attributes for Country and Department ,Then add to Group then add to Distribution
list based on Region/Country
I was thinking along the lines of get-aduser -LDAPFilter "(department=SALES France) and adding a where clause for country.
Any help would be great.
Dec

So I have tried a few variations but get errors on both
get-aduser -LDAPFilter "(&(department=SALES)(c=us))" | Add-ADPrincipalGroupMembership -MemberOf "testgroup"
get-aduser -LDAPFilter "(&(department=SALES)(c=fr))" | Add-ADGroupMember -identity "testgroup"
Add-ADPrincipalGroupMembership : Object reference not set to an instance of an
object.
At line:1 char:86
+ get-aduser -LDAPFilter "(&(department=SALES)(c=fr))" | Add-ADPrincipalGroupMe
mbership <<<< -MemberOf "testgroup"
+ CategoryInfo : NotSpecified: (:) [Add-ADPrincipalGroupMembershi
p], NullReferenceException
+ FullyQualifiedErrorId : Object reference not set to an instance of an ob
ject.,Microsoft.ActiveDirectory.Management.Commands.AddADPrincipalGroupMem
bership

Change to active directory based security

Hi,
I have installed and configured Essbase with shared services based security and not in standalone mode.
The client is now wanting to use active directory based security.
I have seen John Goodwin's (I'm not worthy!) excellent blog on active directory with standalone ( More to life than this...: Standalone Essbase using external authentication ), but as stated I am not on standalone.
Can anyone advise me how the config differs from what you need to do in standalone mode and also how to reinvoke the configuration tool post install / configuration?
Many thanks,
Robert.

You can add the external directory in Shared Services at any point.
Just follow the documentation - Oracle Enterprise Performance Management System Security Configuration Guide
Cheers
John
http://john-goodwin.blogspot.com/

"Domain Users" group in Active Directory does not belong to any Group Membership in LC

Active Directory user belonging to "Domain Users" group does not belong to any Group Membership in LC, why does it not belong to "Domain Users" group?
Any way to correct this issue, without changing group membership on AD side?
If Active Directory user is member of "Domain Admins" or "Users" then these show same group membership in LC.
Thanks.

If you want to use the Domain Users group for the purpose of representing all the users then you can use the "All principals in domain xxx" group which is created by UM.
Coming back to Domain Users group. For determining group membership in AD UM uses "member" attribute of the group object. "Domain Users" group is treated differently by AD. It is the default primary group for all the users and normally members of the primary group are not specified using the member attribute.So when we sync the data from AD "Domain Users" membership does not get completed.

User login report in Active Directory for specific date and time

I want to get User login report in Active Directory for specific date and time e.g user logged in at15-01-2015 from 8:00am to 4:00pm
Is any query, script or any tool available?
Waiting for reply please

You can identify the last logon date and time using my script here: https://gallery.technet.microsoft.com/scriptcenter/Get-Active-Directory-User-bbcdd771
If you would like to get back in time and see when the user did a logon / logoff then you need to have auditing enabled. Once done, you can records from Security log in the event viewer: https://social.technet.microsoft.com/Forums/windowsserver/en-US/98cbecb0-d23d-479d-aa65-07e3e214e2c7/manage-active-directory-users-logon-logoff-events
I have started a Wiki about how to track logon / logoff and it can help too: http://social.technet.microsoft.com/wiki/contents/articles/20422.record-logon-logoff-activities-on-domain-servers-and-workstations-using-group-policy.aspx
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Active Directory - Server 2008 R2 and 2012 R2 (Server Formatting or not productive

Hello guys, I come here to try to clarify a great doubts regarding Server Operating Systems, I will attempt to detail the most of my scenario.
Suppose I have a Server 2008 R2 in production, and this is my Active Directory server (meudominio.local) and am managing through Group Policy settings my workstations that are around 60-70 computers, guys my doubts the thing is, if I need some time to format
and perform a fresh installation of my server as it will be my Active Directory? Of course I will have lost my domain controller and I have to accomplish the placement of each workstation again that enters my domain one by one.
I know there is the option of AD replication, so we call the Active Directory, even for another version of the Operating System, prátia already realized this, but it most often comes not functioning properly, done without replication problems Server 2003 to
2008 R2.
Guys like to know a solution to not having to put my plants in my domain network again one by one, is there any way to backup so that when I reinstalled the system and the AD again in my server stations return to "see" again that server as your domain
controller, even me installing AD with the same domain name before this formatting stations do not respond to this driver in this case do the Network ID or add the station to the area again, so she creates a new user profile for example (Max.meudominio) while
your old profile "guy" still remains on the machine, I adopted the practice of editing the record of this newly created profile and pointing him well for the old user folder which contains all data and settings, eg edit my key "ProfileImagePath"
regedit logged in with the newly created profile (Max.meudominio) ->
(switch "ProfileImagePath" C:\Users\Max.meudominio) thus pointing to the folder before replacing in the field again this season after formatted server, thus ->
(Switch "ProfileImagePath" C:\Users\Max), detail that we give permission for all such user "C:\Users\Max" folder, after that restart the computer and he comes back with the user profile and all your settings.
I wonder if there is another method to perform this procedure, do not know even a backup AD to not have to replace all the seasons again "meudominio.local".
Thank you for your attention!
Translation with Google translator! Sorry.
Matias Duarte Coordenador de Suporte Dual Solucoes® | Soluções em tecnologia da informação

As the practice of replication I know her mostly said she has some flaws when I do the replication of my domain to another server but it works correctly, so having a server "master" and the other ServidorBKP as "slave", in redundancy,
the problem is when I say, and put the "ServidorBKP" being my primary domain controller and disabling my main controller, to disable or turn off my main controller the stations themselves are unable to login because it does not communicate with the
my ServidorBKP "slave" even I put it as the main driver of course.
Regarding the System State as far as I know this option existed in Server 2003.
I also got some information, confer on the links below.
http://msdn.microsoft.com/en-us/library/bb727048.aspx
http://technet.microsoft.com/pt-br/library/cc758435(v=ws.10).aspx
http://technet.microsoft.com/en-us/library/cc961934.aspx
I'm still researching other ways, getting communicate any news to everyone. (Google Translate)
Matias Duarte Coordenador de T.I. Dual Solucoes® | Soluções em tecnologia da informação http://www.matiasduarte.com.br

ISE 1.2 Admin Access via Active Directory

Hi Experts,
Good Day!
I want to configure my ISE 1.2 to authenticate (for admin) against the active directory. I know it is possible but our AD doesn't have any groups named for admins.
Is it possible for the ISE 1.2 to configure a local user ID and check it to the AD for the password of the UserID?
Thanks for your great help.
niks

Niks,
I just got done doing this. First of all you have to have the Active Directory setup as an external data source. Once you do that Click on Administration - - Admin Access.
For the Authentication Type ensure that Password Based is toggled and change your data source to Active Directory (or whatever you named it).
Then click in Administrators - - Admin Users. Click Add a user - - Create Admin User. Ensure to check the External box and you will notice the Password field goes away. Fill out the appropriate information and then assign them to an Admin Group.
Once you are done with that you can test that user by logging out of your ISE session. You will notice that when you try to log back in you will have a choice of the data sources used to authenticate the user. Change the selection to Active Directory and enter the AD user/password for the newly created account you should be good to go.
Make sure that you don't delete or disable your original admin account in this process. (Change the password if you like.)

ISE 1.2 Active Directory Question

Hi,
I have a question regarding using Active Directory as an External Identity Source.
Our customer has 4 AD servers in their domain and thus 4 DNS entries for the domain. When I join ISE to the domain DNS resolves to one address and uses that machine to perform the join operation. What happens if the machine subsequently fails - does my ISE node need to leave and then re-join the domain or is this handled by some other method?
Thanks
Alan

Assuming that they're part of the same AD domain ISE will learn all of the DCs in the domain and you'll likely find after a while that it has moved to a different DC. We have over 100 DCs in our domain and it works just fine, no intervention is required to get it to connect to a different DC if the one it's connected to disappears.

Can't connect to Small Business Server 2003 via Active Directory

I have done lots of searching, both in these forums and the wider internet, and cannot find a solution to my specific problem.
I am trying to connect my G5 (10.3.9) to a Windows network. We have a Microsoft Small Business Server 2003 with Active Directory. The PCs have no problem using this, and I can connect to shares setup on the server via AFP.
But I am having problems when I try to configure the AD plug-in in Directory Access on the Mac. When I click 'Bind', I enter the Server's Administrator username & password and when I click 'OK', it gets to Step 3 of 5 "Verifying Credentials". It ticks away at this step for about 30 seconds, then comes up with error message saying "Invalid user name and password combination."
I have tried other users with admin privileges, but they don't work either. I know the usernames and passwords aren't invalid, because I created them. I have tried fiddling around with other settings in the AD setup, but nothing gets any further.
Without any other 3rd party software (that's my final option), is there something I need to check/change, either on the Mac or the server, to make this Mac to authenticate via AD? Please help!

Hi Andbrowny, thanks for your response.
Your advice didn't really help my Active Directory problem (AD doesn't require SMB does it?), but it gave me some progress on my SMB problem. I can connect via AFP, but previously when I tried to connect via SMB, it kept coming up with the error "Could not connect to the server because the name or password is not correct".
Now, after changing the policies on the server, I get an error -43 message saying "The operation could not be completed because one or more required items cannot be found."
So now I have two problems! SMB is not finding something it needs, and Active Directory is not "verifying credentials".
Actually, I have three problems: When I am connected via AFP, filenames over 31 characters long are truncated on the server, and I can't copy long filenames onto the server without renaming them. I have read that SMB would fix this to a degree (256 characters for the complete file path), but is there anything (a protocol or software) that allows long filenames to be read/written with ease?
Side note: The server is not 100% configured, the bloke installing it still has some work to do, but Active Directory works for all the XP machines, and I can connect to each XP workstation with SMB.

Cisco ISE 1.3 Active Directory issue

Hi Folks
I am having an issue with our Cisco ISE and would love some feedback or a solution. I have to ISE configured to use our Active Directory setup and so far it appears to be functional. I could connect to AD retrieve groups and use AD for authentication. The issue I am experiencing is that when I try to go to the 'Administration > Identity Management > External Sources page and select our AD instance from the left hand side window the screen locks up and refuses to load. Any advice?

hi
i also had this issue (and one of my collegue also) when using Firefox (version 34 and 35)
i managed to create the AD server using IE 10 for example, and after it appears correctly with Firefox
it was before ise1.3patch 1, but i have seen no corrected issue in patch1 release note for this problem
guillaume

Can I configure WS-Sec authentication via Active Directory with OSB or OWSM

Hi
I'm planning a project where I need to add security to a group of proxy services in OSB. I need to authenticate them via WS-Security using Active Directory. Is this possible with OSB or adding OWSM?
Regards,
Néstor Boscán

Hi.
OSB http://docs.oracle.com/cd/E23943_01/dev.1111/e15866/model.htm#i1088877
OWSM
http://docs.oracle.com/cd/E17904_01/doc.1111/e15866/owsm.htm
and
http://docs.oracle.com/cd/E21764_01/web.1111/e13713/owsm_appendix.htm
hope this helps
best
rolando

Xserve file share control via active directory

I have an Intel Xserve running 10.4.11
It has one directory shared via SMB for windows users
I want to join this server to an active directory, that seems fairly straightforward to do.
However am I right that i will be able to control permissions and apply ACLs from the Active Directory to this share once it has bound to the AD.
or will this still have to be done from the Xserve?
TIA

Hi
+"am I right that i will be able to control permissions and apply ACLs from the Active Directory to this share once it has bound to the AD?"+
Not really. Re-sharing a share is never a good idea especially with disparate platforms.
+"I want to join this server to an active directory, that seems fairly straightforward to do"+
If I've understood you correctly you 'bind' the Server to Active Directory using the Active Directory plug-in available in the Directory Access application (/Applications/Utilities). When binding use an AD account name and password that has authority for the AD Domain. The Server should then behave as an NT Domain Member would.
+"Will this still have to be done from the Xserve?"+
Once bound launch WorkGroup Manager and you should 'see' AD Users and Groups. In Workgroup Manager enable the ACLs option for desired volumes if you've not already done so. That's if you want to use ACLs? You could just as easily use the Standard POSIX Permissions model. If you do want to enable ACLs you must restart the Server afterwards for them to 'take'. Enabling/Disabling ACLs always requires a restart on 10.4 Server. On successful log-in start creating your shares if you've not already done so. You can use the Finder or WorkGroup Manager to do this. If using ACLs don't share the volume, share directories/folders instead as ACLs propagate better that way. Add desired Users/Groups from the AD node into the ACLs window. Leave the POSIX Permissions at their defaults. Apply desired privileges. Click Save. When saved click on the gear wheel at the bottom of the window. Select Propagate Permissions. The ACLs checkbox should be automatically ticked. Leave everything else as it is and fire it off.
That should be it?
Tony

Restrict Spiceworks access via Active Directory

Could you specify the base DN Spiceworks is searching in and limit what gets synced? Maybe put the users you want to have Spiceworks access in a separate OU?

I'm trying to figure out a way to restrict access to Spiceworks by way of an Active Directory group.
I want to do this so that I dont have to create new users manually in Spiceworks and so not just anyone with the URL can log in with their AD credentials.
I need this kind of feature if possible so I can move our onboarding/offboarding submission process off of another server and integrate it into Spiceworks like we have with our Change Control Request submission process.
EDIT: More specifically, I'd like to be able to restrict access to the Spiceworks Portal via an AD Group.
This topic first appeared in the Spiceworks Community

ISE Authentcation via Active Directory based on SSID and AD Group

Similar Messages

Maybe you are looking for