ISE & AD EAP-TLS

[ngtransge]

Hello,

I have typical deployment of EAP-TLS in wireless network, with ISE and AD. The  "Perform Binary Certificate Comparison with Certificate retrieved from LDAP or Active Directory", feature is activated.

The problem is, when user accound in AD is disabled, it still can authenticate to ISE without any issue ?

Untill user certificate is deleted from AD.

How is it possible to make sure that when user account is disabled in AD, it is unable to authenticate with EAP-TLS ?

[jrabinow]

I think this should be under operator control with the following attribute that can be used in the authorization policy to define a condition for what should be performed in such a case:

IdentityAccessRestricted   that is created automatically in the active directory dictionary

[ngtransge]

Hello jrabinow,

If I understand correctly i should check  IdentityAccessRestricted  attribute in Autorization policy, and if it present then it means that user was disabled in AD, and denyaccess for user ?

thank you,