LDAP Identity Stores

# On FreeIPA server
echo "YourSecurePassword" | ipa user-add ise-bind \
  --first="ISE" \
  --last="Bind Account" \
  --password

cat > /tmp/ipa-01-ldap.xml << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<ns0:ersLdap xmlns:ns0="identitystores.ers.ise.cisco.com"
             xmlns:xs="http://www.w3.org/2001/XMLSchema"
             xmlns:ns1="ers.ise.cisco.com"
             xmlns:ers="ers.ise.cisco.com"
             name="ipa-01"
             description="FreeIPA LDAP identity source for EAP-TTLS authentication">
   <connectionSettings>
      <alwaysAccessPrimaryFirst>true</alwaysAccessPrimaryFirst>
      <failbackRetryDelay>5</failbackRetryDelay>
      <failoverToSecondary>false</failoverToSecondary>
      <primaryServer>
         <adminDN>uid=ise-bind,cn=users,cn=accounts,dc=dc=inside,dc=domusdigitalis,dc=dev</adminDN>
         <adminPassword>YOUR_PASSWORD</adminPassword>
         <enableForceReconnect>false</enableForceReconnect>
         <enableSecureConnection>false</enableSecureConnection>
         <enableServerIdentityCheck>false</enableServerIdentityCheck>
         <forceReconnectTime>20</forceReconnectTime>
         <hostName>10.50.1.100</hostName>
         <issuerCACertificate></issuerCACertificate>
         <maxConnections>20</maxConnections>
         <port>389</port>
         <serverTimeout>10</serverTimeout>
         <trustCertificate></trustCertificate>
         <useAdminAccess>true</useAdminAccess>
      </primaryServer>
      <specifyServerForEachISENode>false</specifyServerForEachISENode>
   </connectionSettings>
   <directoryOrganization>
      <groupDirectorySubtree>cn=groups,cn=accounts,dc=dc=inside,dc=domusdigitalis,dc=dev</groupDirectorySubtree>
      <macFormat>DASH</macFormat>
      <prefixSeparator>\</prefixSeparator>
      <stripPrefix>false</stripPrefix>
      <stripSuffix>false</stripSuffix>
      <suffixSeparator> </suffixSeparator>
      <userDirectorySubtree>cn=users,cn=accounts,dc=dc=inside,dc=domusdigitalis,dc=dev</userDirectorySubtree>
   </directoryOrganization>
   <enablePasswordChangeLDAP>false</enablePasswordChangeLDAP>
   <generalSettings>
      <certificate>userCertificate</certificate>
      <groupMapAttributeName>memberOf</groupMapAttributeName>
      <groupMemberReference>USERNAME</groupMemberReference>
      <groupNameAttribute>cn</groupNameAttribute>
      <groupObjectClass>groupOfNames</groupObjectClass>
      <groupReference>GROUP_TO_USER</groupReference>
      <schema>CUSTOM</schema>
      <userInfoAttributes>
         <country></country>
         <department></department>
         <email>mail</email>
         <firstName>givenName</firstName>
         <lastName>sn</lastName>
         <locality></locality>
         <organizationalUnit></organizationalUnit>
         <stateOrProvince></stateOrProvince>
         <streetAddress></streetAddress>
         <telephone>telephoneNumber</telephone>
      </userInfoAttributes>
      <userNameAttribute>uid</userNameAttribute>
      <userObjectClass>person</userObjectClass>
   </generalSettings>
</ns0:ersLdap>
EOF

curl -k -X POST "https://${ISE_PAN_IP}:9060/ers/config/ldap" \
  -H "Content-Type: application/xml" \
  -H "Accept: application/xml" \
  -u "${ISE_API_USER}:${ISE_API_PASS}" \
  -d @/tmp/ipa-01-ldap.xml \
  -w "\nHTTP_STATUS: %\{http_code\}\n"

# Expected: HTTP_STATUS: 201

shred -vuzn 3 /tmp/ipa-01-ldap.xml

curl -k -s "https://${ISE_PAN_IP}:9060/ers/config/ldap/rootcacertificates" \
  -H "Accept: application/json" \
  -u "${ISE_API_USER}:${ISE_API_PASS}"

curl -k -s "https://${ISE_PAN_IP}:9060/ers/config/ldap/issuercacertificates" \
  -H "Accept: application/json" \
  -u "${ISE_API_USER}:${ISE_API_PASS}"

<?xml version="1.0" encoding="UTF-8"?>
<ns0:ersLdap xmlns:ns0="identitystores.ers.ise.cisco.com"
             xmlns:xs="http://www.w3.org/2001/XMLSchema"
             xmlns:ns1="ers.ise.cisco.com"
             xmlns:ers="ers.ise.cisco.com"
             name="ipa-01"
             description="FreeIPA LDAP identity source for EAP-TTLS authentication">
   <connectionSettings>
      <!-- ... connection settings ... -->
   </connectionSettings>
   <directoryOrganization>
      <!-- ... directory settings ... -->
   </directoryOrganization>
   <enablePasswordChangeLDAP>false</enablePasswordChangeLDAP>
   <generalSettings>
      <!-- ... general settings ... -->
   </generalSettings>
   <groups>
      <groupsNames>cn=printers,cn=groups,cn=accounts,dc=inside,dc=domusdigitalis,dc=dev</groupsNames>
      <groupsNames>cn=ipausers,cn=groups,cn=accounts,dc=inside,dc=domusdigitalis,dc=dev</groupsNames>
   </groups>
</ns0:ersLdap>

# 1. Get current LDAP store ID
LDAP_ID=$(curl -k -s "https://${ISE_PAN_IP}:9060/ers/config/ldap" \
  -H "Accept: application/json" \
  -u "${ISE_API_USER}:${ISE_API_PASS}" | \
  jq -r '.SearchResult.resources[] | select(.name=="ipa-01") | .id')

# 2. Delete existing store
curl -k -X DELETE "https://${ISE_PAN_IP}:9060/ers/config/ldap/${LDAP_ID}" \
  -H "Accept: application/xml" \
  -u "${ISE_API_USER}:${ISE_API_PASS}"

# 3. Recreate with updated groups
curl -k -X POST "https://${ISE_PAN_IP}:9060/ers/config/ldap" \
  -H "Content-Type: application/xml" \
  -H "Accept: application/xml" \
  -u "${ISE_API_USER}:${ISE_API_PASS}" \
  -d @/tmp/ipa-01-with-groups.xml

curl -k -s "https://${ISE_PAN_IP}:9060/ers/config/ldap/${LDAP_ID}/groups" \
  -H "Accept: application/json" \
  -u "${ISE_API_USER}:${ISE_API_PASS}" | jq '.groups[]'

# Create authentication rule using ipa-01 LDAP
# Policy Set: Domus-Secure 802.1X
# Current rules: Rank 0-2 are EAP-TLS and iPSK - add at rank 3
netapi ise add-auth-rule "Domus-Secure 802.1X" \
  "FreeIPA_EAP-TTLS_Auth" \
  "ipa-01" \
  --dict "Network Access" \
  --attr "EapTunnel" \
  --value "EAP-TTLS" \
  --rank 3

netapi ise get-auth-rules "Domus-Secure 802.1X"

╭──────────────────────────────────────────────────────────────────────────────────────────╮
│ Authentication Rules                                                                     │
╰────────────────────────────────── Domus-Secure 802.1X ───────────────────────────────────╯
    #    Rule Name                Identity Source       If Fail    If Not Found    State
    0    BYOD_Certificate_Auth    BYOD_Cert_Profile     REJECT     REJECT          enabled
    1    EAP_TLS_Certificate_…    AD_Cert_Profile       REJECT     REJECT          enabled
    2    iPSK AuthC               iPSKManager           REJECT     REJECT          enabled
    3    FreeIPA_EAP-TTLS_Auth    ipa-01                REJECT     REJECT          enabled  <-- FreeIPA LDAP
    4    Default                  Internal Endpoints    REJECT     CONTINUE        enabled

FreeIPA Group (printers)
        ↓
ISE LDAP Store (ipa-01) imports group
        ↓
Authorization Rule matches: ipa-01:ExternalGroups contains "printers"
        ↓
Authorization Profile assigned (e.g., Domus_IoT_Profile)
        ↓
Device gets VLAN + dACL

# Create authorization profile with DATA_VLAN (VLAN 10)
# Domus-Secure is 802.1X Enterprise on VLAN 10
netapi ise create-authz-profile FreeIPA_Printers \
  --vlan DATA_VLAN \
  --descr "FreeIPA-authenticated printers - EAP-TTLS on Domus-Secure"

netapi ise get-authz-profile FreeIPA_Printers

╭─────────────────────────────────────────────────────────────────────────────╮
│ Authorization Profile: FreeIPA_Printers                                     │
╰─────────────────────────────────────────────────────────────────────────────╯
  name        FreeIPA_Printers
  vlan        {'nameID': 'DATA_VLAN', 'tagID': 10}
  accessType  ACCESS_ACCEPT

# Add authorization rule matching FreeIPA printers group
# Policy Set: Domus-Secure 802.1X (wireless EAP-TLS)
netapi ise add-authz-rule "Domus-Secure 802.1X" \
  "FreeIPA_Printers_EAP-TTLS" \
  "FreeIPA_Printers" \
  --dict "ipa-01" \
  --attr "ExternalGroups" \
  --value "cn=printers,cn=groups,cn=accounts,dc=inside,dc=domusdigitalis,dc=dev" \
  --operator "contains" \
  --rank 2

netapi ise get-authz-rules "Domus-Secure 802.1X"

╭──────────────────────────────────────────────────────────────────────────────────────────╮
│ Authorization Rules                                                                      │
╰────────────────────────────────── Domus-Secure 802.1X ───────────────────────────────────╯
    #    Rule Name                Condition               Profile(s)               State
    0    BYOD_Registered_Devi…    EndPoints:BYODRegis…    Domus_BYOD_Full_Acce…    enabled
                                  equals 'Yes'
    1    EAP_TLS_Trusted_Users    Network                 Domus_Secure_Profile     enabled
                                  Access:EapAuthentic…
                                  equals 'EAP-TLS'
    2    FreeIPA_Printers_EAP…    ipa-01:ExternalGrou…    FreeIPA_Printers         enabled  <-- FreeIPA printers
                                  contains
                                  'cn=printers,cn=gro…
    3    iPSK Trusted Data        iPSKManager:Externa…    iPSK-Auth                enabled
                                  equals 'Trust-Data'
    4    Default                  (default)               DenyAccess               enabled

netapi ise add-authz-rule "Domus-Secure 802.1X" \
  "FreeIPA_Printers_EAP-TTLS" \
  "FreeIPA_Printers" \
  --and "Network Access:EapTunnel:equals:EAP-TTLS" \
  --and "ipa-01:ExternalGroups:contains:cn=printers,cn=groups,cn=accounts,dc=inside,dc=domusdigitalis,dc=dev" \
  --rank 2

# On FreeIPA server
ipa user-add brother-mfc \
  --first="Brother" \
  --last="MFC-L2750DW" \
  --password

ipa group-add-member printers --users=brother-mfc

# Create XML with groups included
cat > /tmp/ipa-01-with-groups.xml << 'XMLEOF'
<?xml version="1.0" encoding="UTF-8"?>
<ns0:ersLdap xmlns:ns0="identitystores.ers.ise.cisco.com"
             xmlns:xs="http://www.w3.org/2001/XMLSchema"
             xmlns:ns1="ers.ise.cisco.com"
             xmlns:ers="ers.ise.cisco.com"
             name="ipa-01"
             description="FreeIPA LDAP identity source for EAP-TTLS authentication">
   <connectionSettings>
      <alwaysAccessPrimaryFirst>true</alwaysAccessPrimaryFirst>
      <failbackRetryDelay>5</failbackRetryDelay>
      <failoverToSecondary>false</failoverToSecondary>
      <primaryServer>
         <adminDN>uid=ise-bind,cn=users,cn=accounts,dc=inside,dc=domusdigitalis,dc=dev</adminDN>
         <adminPassword>YOUR_ISE_BIND_PASSWORD</adminPassword>
         <enableForceReconnect>false</enableForceReconnect>
         <enableSecureConnection>false</enableSecureConnection>
         <enableServerIdentityCheck>false</enableServerIdentityCheck>
         <forceReconnectTime>20</forceReconnectTime>
         <hostName>10.50.1.100</hostName>
         <issuerCACertificate></issuerCACertificate>
         <maxConnections>20</maxConnections>
         <port>389</port>
         <serverTimeout>10</serverTimeout>
         <trustCertificate></trustCertificate>
         <useAdminAccess>true</useAdminAccess>
      </primaryServer>
      <specifyServerForEachISENode>false</specifyServerForEachISENode>
   </connectionSettings>
   <directoryOrganization>
      <groupDirectorySubtree>cn=groups,cn=accounts,dc=inside,dc=domusdigitalis,dc=dev</groupDirectorySubtree>
      <macFormat>DASH</macFormat>
      <prefixSeparator>\</prefixSeparator>
      <stripPrefix>false</stripPrefix>
      <stripSuffix>false</stripSuffix>
      <suffixSeparator> </suffixSeparator>
      <userDirectorySubtree>cn=users,cn=accounts,dc=inside,dc=domusdigitalis,dc=dev</userDirectorySubtree>
   </directoryOrganization>
   <enablePasswordChangeLDAP>false</enablePasswordChangeLDAP>
   <generalSettings>
      <certificate>userCertificate</certificate>
      <groupMapAttributeName>memberOf</groupMapAttributeName>
      <groupMemberReference>USERNAME</groupMemberReference>
      <groupNameAttribute>cn</groupNameAttribute>
      <groupObjectClass>groupOfNames</groupObjectClass>
      <groupReference>GROUP_TO_USER</groupReference>
      <schema>CUSTOM</schema>
      <userInfoAttributes>
         <country></country>
         <department></department>
         <email>mail</email>
         <firstName>givenName</firstName>
         <lastName>sn</lastName>
         <locality></locality>
         <organizationalUnit></organizationalUnit>
         <stateOrProvince></stateOrProvince>
         <streetAddress></streetAddress>
         <telephone>telephoneNumber</telephone>
      </userInfoAttributes>
      <userNameAttribute>uid</userNameAttribute>
      <userObjectClass>person</userObjectClass>
   </generalSettings>
   <groups>
      <groupsNames>cn=printers,cn=groups,cn=accounts,dc=inside,dc=domusdigitalis,dc=dev</groupsNames>
      <groupsNames>cn=ipausers,cn=groups,cn=accounts,dc=inside,dc=domusdigitalis,dc=dev</groupsNames>
   </groups>
</ns0:ersLdap>
XMLEOF

# Submit to ISE
curl -k -X POST "https://${ISE_PAN_IP}:9060/ers/config/ldap" \
  -H "Content-Type: application/xml" \
  -H "Accept: application/xml" \
  -u "${ISE_API_USER}:${ISE_API_PASS}" \
  -d @/tmp/ipa-01-with-groups.xml \
  -w "\nHTTP_STATUS: %\{http_code\}\n"

# Cleanup
shred -vuzn 3 /tmp/ipa-01-with-groups.xml

# Create authentication rule to use ipa-01 for EAP-TTLS
netapi ise add-auth-rule "Domus-Secure 802.1X" \
  "FreeIPA_EAP-TTLS_Auth" \
  "ipa-01" \
  --dict "Network Access" \
  --attr "EapTunnel" \
  --value "EAP-TTLS" \
  --rank 3

# Create authorization profile for printers (DATA_VLAN = VLAN 10)
netapi ise create-authz-profile FreeIPA_Printers \
  --vlan DATA_VLAN \
  --descr "FreeIPA-authenticated printers - EAP-TTLS on Domus-Secure"

# Add authorization rule to Domus-Secure 802.1X policy set
netapi ise add-authz-rule "Domus-Secure 802.1X" \
  "FreeIPA_Printers_EAP-TTLS" \
  "FreeIPA_Printers" \
  --dict "ipa-01" \
  --attr "ExternalGroups" \
  --value "cn=printers,cn=groups,cn=accounts,dc=inside,dc=domusdigitalis,dc=dev" \
  --operator "contains" \
  --rank 2

# Check ISE authentication rules
netapi ise get-auth-rules "Domus-Secure 802.1X"

# Check ISE authorization rules
netapi ise get-authz-rules "Domus-Secure 802.1X"

# Check ISE live logs for printer MAC
netapi ise mnt session "PRINTER_MAC_ADDRESS"

# Or via ISE GUI
# Operations → RADIUS → Live Logs