topic Re: Identity Collector pxGrid parsing issue in Firewall and Security Management

Identity Collector pxGrid parsing issue

Alex_Shpilman — Fri, 31 May 2019 08:10:18 GMT

Hi,

I have Identity Collector integrated with AD and Cisco ISE.

The users' information coming from AD is based on logon names, while ISE pxGrid is based on UPNs.

When the users information from ISE is passed to the secure gateway, it can't find a match in AD.

For O365 compatibility, the UPNs are equal to the email addresses, while the logon names are in a different format so the IDC alias feature can't resolve the issue.

Is there a way to change the method IDC pareses the bulk connection table downloaded from Cisco ISE?

Any other ideas?

I logged a TAC case and was advised to change the IDC UserLoginAttr using GuiDBEdit under the relevant gateway, which didn't make any difference.

Thanks!

Re: Identity Collector pxGrid parsing issue

PhoneBoy — Mon, 03 Jun 2019 03:57:02 GMT

What do you think @Royi_Priov ?

Re: Identity Collector pxGrid parsing issue

Royi_Priov — Tue, 04 Jun 2019 11:07:24 GMT

Hi,

Please share the TAC SR details.

Is your usernames representations matching to the latest sentence in sk149854?

Thanks,

Royi.

Re: Identity Collector pxGrid parsing issue

Alex_Shpilman — Tue, 04 Jun 2019 11:17:34 GMT

Hi Royi,

I will send you a message with the SR details.

However, the last scenario is exactly the situation I've got.

I will perform some testing and let you know the results.

Thanks for your help!

Re: Identity Collector pxGrid parsing issue

Alex_Shpilman — Wed, 05 Jun 2019 02:29:13 GMT

The CustomLoginAttr works as expected, I just to change change the string to the below:

|(sAMAccountName=<<>>)(UserPrincipalName=<<>>@mydomain.com)

I had to add the domain to the query as it's being stripped off by the Identity Collectors, I am wondering if this behavior can be amended.

This wouldn't work if we had UPNs from multiple domains, but luckily this is not the case.

Re: Identity Collector pxGrid parsing issue

Royi_Priov — Wed, 05 Jun 2019 09:05:17 GMT

That's great!

I'm happy to understand it's now working.

Thanks,

Royi.