A manufacturer points ISE at its OpenLDAP directory for plant-floor badge logins. The directory has anonymous searches disabled, the engineer wants query rights limited to the user and group branches, and ISE must resolve a user's distinguished name before the password check runs. Which bind account should the ISE identity source use?
Select an answer to reveal the explanation.
Short Explanation
Since anonymous searches are blocked and you want to limit ISE to the user and group branches, a dedicated read-only service account is the right fit. A bind account is like a library card that lets ISE find the shelf before the user’s own password is checked.
Full Explanation
A dedicated read-only service account that can search the user and group base distinguished names meets the stated requirements: ISE can find a user entry and obtain its distinguished name before checking the password, while directory permissions limit searches to the required branches. An account with search rights across the entire directory tree can support lookup, but its scope exceeds the requested user-and-group branches; read-only access alone does not enforce the desired search boundaries. An account that searches users and relies on groups being read from user attributes does not provide search access to the group branch that this design requires. An account that searches groups while usernames are mapped to known DNs does not let ISE search the user branch to resolve the user’s DN before password validation. Exam caveat: LDAP identity-source behavior depends on platform and configuration, so distinguish the bind account used for directory searches from the credentials used for the user’s password check. Practical check: test the configured bind account against both specified base DNs, confirm searches outside those branches are denied, and verify that ISE resolves a test user’s DN before attempting password validation.