The Cisco ISE Administrative Portal can be integrated with RSA Cloud Access Service (CAS) to provide SAML-based authentication for administrators. By configuring CAS as the authentication provider, administrators are redirected to RSA for authentication before gaining access to the Cisco ISE Administrative Portal.

Procedure

1. Navigate to Administration > System > Admin Access. 
   
2. On the Authentication tab, navigate to Authentication Method > Admin Portal.
3. In the Password-based Identity Source drop-down list, select the RSA External Identity Source that was created earlier.
   Note: A new Identity Source Entity should be created, specifically, Admin Portal.
   
4. For the Admin Portal use case, configure a group attribute in CAS and include it in the SAML assertion. Then, map the group attribute in Cisco ISE to authorize the user and assign the appropriate administrative permissions.
   • Attribute name: Name of the attribute that will contain the group/role name.
   • Property: Field containing the value of the group/role.
     Note: The fields shown in the screenshot are provided for demonstration purposes only. Use the appropriate fields based on your Active Directory (AD) configuration.
     
5. Navigate to Administration > Identity Management > External Identity Sources and open the Identity Source Entity created for the Admin Portal.
6. Edit the entity, click the Groups tab, and create a new group attribute.
   • Group Membership Attribute: Name of the attribute in the RSA SAML Assertion that will contain the group/role name. This should match the attribute name configured in RSA.
   • Name in Assertion: The value of the group attribute sent in the Assertion.
   • Name in ISE: Choose the appropriate admin rights for the role sent in the Assertion.