A food processing plant has 600 employees in Active Directory and 40 legacy machine accounts in an OpenLDAP server slated for a merge next year. Past domain controller outages stopped every plant login, and the team keeps three break-glass ISE accounts for emergencies. Which identity source sequence order should be configured for plant logins?
Select an answer to reveal the explanation.
Short Explanation
You're setting the order ISE checks identity stores. Active Directory leads because it holds the staff accounts, OpenLDAP is next for the legacy machine accounts, and the internal store is last for break-glass accounts. Configure the sequence's failure handling as needed; placing a store later does not by itself guarantee fallback after an authentication failure.
Full Explanation
An identity source sequence checks identity stores in the configured order. By default, ISE proceeds to the next store when it does not find the user in the current store; if a user is found but authentication fails, ISE does not automatically try the next store. Configure the applicable identity source sequence failure-handling option if you want that failure treated as if the user were not found. Active Directory first suits the staff accounts, OpenLDAP next suits the legacy machine accounts, and the internal user store last includes the break-glass accounts in the sequence. Starting with OpenLDAP reverses the intended precedence, while leaving internal accounts out of the sequence makes them unavailable through this sequence. Whether another store is tried when a directory is unavailable depends on the configured failure handling and the nature of the error. The sequence applies to password-based authentication; EAP-TLS certificate authentication does not use it.