ISE using 2 domains with trust established

Question

Hi,
I need to authenticate wireless network users from two different domains
abc.company.com
cde.company.com
There is trust between domains and ISE joined abc.company.com and it can authenticate and authorize users without issues.
Users from cde.company.com cannot be authenticated (I don't even get to authorization part).
My identity source list has only External ID listed and when I see what is the reason of failure, message states that Authentication has failed (not authorization) because user cannot be found in any identity listed.
Now, users from abc and cde companies are logging with their usernames only. Should they try to login with cde.company\username or something?
Has anyone done this before?
Thanks.

Answer 1

I have trust. I can get the user information with cde\user and  [email protected], but authentication is still not working. So, I see  the user, but it is still not being authenticated by the policy.
Here is log:
11001  Received RADIUS Access-Request
11017  RADIUS created a new session
Evaluating Service Selection Policy
15048  Queried PIP
15048  Queried PIP
15004  Matched rule
11507  Extracted EAP-Response/Identity
12300  Prepared EAP-Request proposing PEAP with challenge
11006  Returned RADIUS Access-Challenge
11001  Received RADIUS Access-Request
11018  RADIUS is re-using an existing session
12302  Extracted EAP-Response containing PEAP challenge-response and accepting PEAP as negotiated
12318  Successfully negotiated PEAP version 0
12800  Extracted first TLS record; TLS handshake started
12805  Extracted TLS ClientHello message
12806  Prepared TLS ServerHello message
12807  Prepared TLS Certificate message
12810  Prepared TLS ServerDone message
12305  Prepared EAP-Request with another PEAP challenge
11006  Returned RADIUS Access-Challenge
11001  Received RADIUS Access-Request
11018  RADIUS is re-using an existing session
12304  Extracted EAP-Response containing PEAP challenge-response
12318  Successfully negotiated PEAP version 0
12812  Extracted TLS ClientKeyExchange message
12804  Extracted TLS Finished message
12801  Prepared TLS ChangeCipherSpec message
12802  Prepared TLS Finished message
12816  TLS handshake succeeded
12509  EAP-TLS full handshake finished successfully
12305  Prepared EAP-Request with another PEAP challenge
11006  Returned RADIUS Access-Challenge
11001  Received RADIUS Access-Request
11018  RADIUS is re-using an existing session
12304  Extracted EAP-Response containing PEAP challenge-response
12313  PEAP inner method started
11521  Prepared EAP-Request/Identity for inner EAP method
12305  Prepared EAP-Request with another PEAP challenge
11006  Returned RADIUS Access-Challenge
11001  Received RADIUS Access-Request
11018  RADIUS is re-using an existing session
12304  Extracted EAP-Response containing PEAP challenge-response
11522  Extracted EAP-Response/Identity for inner EAP method
11806  Prepared EAP-Request for inner method proposing EAP-MSCHAP with challenge
12305  Prepared EAP-Request with another PEAP challenge
11006  Returned RADIUS Access-Challenge
11001  Received RADIUS Access-Request
11018  RADIUS is re-using an existing session
12304  Extracted EAP-Response containing PEAP challenge-response
11808  Extracted EAP-Response containing EAP-MSCHAP challenge-response for inner method and accepting EAP-MSCHAP as negotiated
Evaluating Identity Policy
15006  Matched Default Rule
15013  Selected Identity Store - AD-Suffolk
24430  Authenticating user against Active Directory
24412  User not found in Active Directory
22056  Subject not found in the applicable identity store(s)
22058  The advanced option that is configured for an unknown user is used
22062  The 'Drop' advanced option is configured in case of a failed authentication request
12315  PEAP inner method finished with failure
22028  Authentication failed and the advanced options are ignored