In the process of integrating ISE 1.2 into our environment with the eventual intent to replace ACS 5.x and having a challenge adding an RSA SecurID server as an external identity source.

In ACS, we would create an internal user but configure the password to be handled externally and uses PAP or whatever to communicate with RSA.

I don't see this option in ISE, only to use the RSA SecurID as a direct Identity Source, the problem is that if I try to authenticate to ISE using a device such as an iPhone, which is using MS-CHAPv2 by default, it produces an error in the authentication logs that the device is using a protocol not supported by the identity source.

So what is the proper way to configure ISE to allow users to authenticate with a one-time-password against RSA SecurID?