This service provides access to ISE Session Directory. There are 2 objects that can be accessed:

• Session
• UserGroup

UserGroup is being separated out from Session object because of its size and static nature.

ServiceLookup may return more than one nodes providing this service. Each node is a replica of each other. In other words, connecting to one of these nodes is sufficient.

Go through the list of nodes until one succeed. If none of them work, sleep for retry. Redo ServiceLookup before retry as there maybe service updates.

This is used to get all sessions. A startTimestamp can be optionally used in the request to get sessions newer than the timestamp.

If no session is found, sessions will be an empty array.

{
  "startTimestamp": ISO8601 Datetime (optional)
  "filter": JMESFilter for each session object. e.g. "nasIpAddress == '10.0.0.1'" (optional. since ISE 3.4)

}

Refer pxGrid filtering for more details on how to use filters.

{
  "sessions": [ 
    array of session objects
  ]
}

This is used to get sessions for recovery purpose in case of loss. Loss can be detected if published data has a gap in sequence number. The startTimestamp used in the request should be the timestamp attribute of the last message received. The endTimestamp is optional. It should be the timestamp attribute of the first message received after the gap in sequence. If not specified, the current time will be used.

If no session is found, sessions will have an empty array.

It is possible that the startTimestamp specified is out of the recoverable time range. In that case, a "416 Requested Range Not Satisfiable" will be returned and the client should clear cache and get all sessions with getSessions call.

{
  "startTimestamp": ISO8601 Datetime,
  "endTimestamp": ISO8601 Datetime
}

{
  "sessions": [ 
    array of session objects
  ]
}

This query returns a session object if found. If not, HTTP status "204 No content" will be returned.

{
  "ipAddress": string (required)
}

{
  session object
}

This query returns a session object if found. If not, HTTP status "204 No content" will be returned.

{
  "macAddress": string (required)
}

{
  session object
}

This gets all user groups. These user groups represent only the groups of the users that have been authenticated by ISE.

If no user group is found, userGroups will have an empty array.

{
  "filter": JMESFilter for each user group object (optional. since ISE 3.4)
  (e.g. "(groups[].name.contains(@, 'User Identity Groups: Employee')).contains(@, `true`)" )
}

Refer pxGrid filtering for more details on how to use filters.

{
  "userGroups": [
    array of userGroup objects
  ]
}

This query returns an array of group object.

If the user has no group association, groups will have an empty array.

If user does not exist, HTTP status "204 No content" will be returned.

{
  "userName": string (required)
}

{
  "groups": [ 
    array of group objects
  ]
}

This topic provides events of Session Directory updates. Events are only published if all these are true:

• Session has IP address.
• A new session, or change in session attributes apart from timestamps and statictics.
• Session updated by Radius Accounting, AD probe, profiler, posture and MDM syslogs.

For creating a cache of sessions, the getSessions query can be used to build the initial cache.

{
  "sequence": integer sequence number for loss detection (since ISE 3.0)
  "sessions": [ 
    array of session objects
  ]
}

The publish rate is limited to prevent overloading the consumers and networks. From ISE 2.3 to 2.7, the rate limit is 50 batched events per message and 4 msg/s, a total of 200 events/s. Since ISE 3.0, the rate limit has increased to 50 batched events per messages of 40 msg/s, a total of 2000 events/s.

This topic is similar to sessionTopic except events are also published for sessions without IP address

This topic provides events for user groups updates. Only changes will be published. For creating a cache of user groups, the getUserGroups query can be used to build the initial cache.

{
  "userGroups": [
    array of userGroup objects
  ]
}

"session" object
{
  "timestamp": "2017-06-29T13:22:46.788-07:00",
  "state": "STARTED",
  "userName": "user1",
  "callingStationId": "33:33:33:33:33:33",
  "auditSessionId": "101",
  "ipAddresses": ["1.2.3.4"],
  "macAddress": "33:33:33:33:33:33",
  "nasIpAddress": "172.21.170.242",
  "adNormalizedUser": "user1",
  "providers": ["None"],
  "endpointCheckResult": "none",
  "identitySourcePortStart": 0,
  "identitySourcePortEnd": 0,
  "identitySourcePortFirst": 0,
  "networkDeviceProfileName": "Cisco",
  "mdmMacAddress": "33:33:33:33:33:33",
  "mdmOsVersion": "9.3.5",
  "mdmRegistered": true,
  "mdmCompliant": true,
  "mdmDiskEncrypted": false,
  "mdmJailBroken": false,
  "mdmPinLocked": true,
  "mdmModel": "iPad mini",
  "mdmManufacturer": "Apple",
  "mdmImei": "dummy15",
  "mdmMeid": "dummy16",
  "mdmUdid": "dummy17",
  "mdmSerialNumber": "dummy18",
  "mdmDeviceManager": "sns"
}

"userGroup" object
{  
   "userName":"user1",
   "groups":[  
      {  
         "name":"User Identity Groups:Employee",
         "type":"IDENTITY"
      },
      {  
         "name":"Workstation",
         "type":"IDENTITY"
      }
   ]
}