A customer is deploying local web authentication. Which software application must be implemented on Cisco ISE to utilize as a directory service?

Cisco Identity Services Engine (ISE) uses the Lightweight Directory Access Protocol (LDAP) to connect to and query external directory services for user authentication and attribute retrieval. When configuring Local Web Authentication (LWA), ISE must validate the credentials entered by the user against an identity store. By configuring ISE as an LDAP client, it can securely communicate with an external LDAP-compliant directory server (such as Microsoft Active Directory or OpenLDAP) to perform these lookups. This makes LDAP the essential protocol and software component for integrating external directory services.

A. Solaris Directory Service: This is a specific product example of a directory service. Cisco ISE would connect to it using the LDAP protocol, making LDAP the more fundamental and correct answer.

C. SAML: Security Assertion Markup Language (SAML) is a federation protocol used for Single Sign-On (SSO) between an Identity Provider and a Service Provider. It is not a directory service protocol.

D. Novell eDirectory: This is another specific product example of a directory service. As with Solaris, ISE uses the LDAP protocol to integrate with it, making LDAP the correct underlying technology.

1. Cisco Identity Services Engine Administrator Guide

Release 3.1

"LDAP Identity Sources" section: "Cisco ISE supports LDAP for authentication and for attribute lookups in LDAP servers... You can configure Cisco ISE to use an LDAP identity source to authenticate users and fetch attributes (such as group membership) from the LDAP server." This establishes LDAP as the primary mechanism for directory service integration.

2. Cisco Identity Services Engine Administrator Guide

Release 3.1

"External Identity Sources in Cisco ISE" section: This section lists the types of external identity sources ISE can use

explicitly naming "LDAP" as a distinct category alongside others like Active Directory

RADIUS

and SAML. This differentiates LDAP as the protocol-based choice for generic directory services.

3. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Web Authentication" section: This chapter describes how web authentication policies rely on identity sequence configurations

which in turn point to identity sources like an external LDAP server to validate user credentials. This directly links the LWA feature to the need for a configured identity source like LDAP.