Admin Autentication and Authorization from Two AD Forests

[kkaminsk]

Folks,

I have a customer POC I am doing and they have admins across two separate AD forests.  I cannot reference an AD Join Point when referencing an External Identity source for admin users - I can only select either one or the other AD Forests.

On the RBAC controls I only see groups from that one AD Forest also.

I am running ISE 2.0.1.

How can I use admin authentication and authorization with users in both AD Forests?  Is this supported?

Regards.

[hslai · Accepted solution]

What you observed is expected. ISE external admin with AD is only supported with one single joint point. The only way to allow AD users from another forest is to establish two-way trusts.