Question

A security engineer is integrating Cisco ISE with an OpenLDAP directory that stores user accounts and group memberships. The requirement is to authenticate users with PEAP-MSCHAPv2 and to authorize them based on their group membership. During testing, authentication consistently fails for all users, though the LDAP identity store test connection succeeds and group lookups return correct results. What is the most likely cause of the authentication failure?

Accepted Answer

LDAP identity stores do not support PEAP-MSCHAPv2 because the protocol requires access to the plaintext or reversibly encrypted password, which LDAP cannot provide for MSCHAPv2 challenge-response validation

Answer

The LDAP subject search base is misconfigured, so ISE cannot locate the user objects during authentication

Answer

ISE requires a secure LDAPS connection on port 636 before any EAP method can be used with an LDAP store

Answer

The LDAP server must be joined to the ISE node as an external RADIUS token server to process EAP requests