topic Cisco ISE Sponsor Portal – Active Directory Login help. in Network Access Control

Cisco ISE Sponsor Portal – Active Directory Login help.

Pete Bauer — Mon, 11 Mar 2019 02:22:25 GMT

Hello,

We’re trying to setup our Sponsor Portal to query an Active Directory group for login credientials and having some trouble. Right now we’re receiving the error, “Sponsor authentication has failed : Sponsorgroup not found for user”

Is there a configuration guide available explaining how to configure this?

Any help would be great.

Thanks,

Pete

Cisco ISE Sponsor Portal – Active Directory Login help.

Tarik Admani — Wed, 01 Aug 2012 19:46:41 GMT

Pete,

Give this a try and see if this gets you rolling - http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_guest_pol.html#wp1096365

Thanks,

Tarik Admani
*Please rate helpful posts*

Re: Cisco ISE Sponsor Portal – Active Directory Login help.

Pete Bauer — Thu, 02 Aug 2012 12:02:43 GMT

I have that configured per the link you provided.

I'm still recieving the following error, "Sponsor authentication has failed : Sponsorgroup not found for user"

I have an authorization policy setup however I don't think it's even making it that far.

Thanks,
Pete

Re: Cisco ISE Sponsor Portal – Active Directory Login help.

jrabinow — Thu, 02 Aug 2012 12:11:50 GMT

Do you see in the authentiaction details which AD groups were retrieved?

One suggestion. I see that the name you have given to the AD store is AD_washcty.local. May be worth trying a name that does not include a '.' character

Re: Cisco ISE Sponsor Portal – Active Directory Login help.

Pete Bauer — Thu, 02 Aug 2012 12:17:46 GMT

Does this screen cap help? There is no Identity Group associated with the login request.

We've used 'AD_washcty.local' with all our other AD based authentication on ISE without issue.

Thanks again,

Pete

Cisco ISE Sponsor Portal – Active Directory Login help.

Tarik Admani — Thu, 02 Aug 2012 14:46:25 GMT

Pete,

That is interesting. Can you can post a screenshot of the "memberOf" section of this user account in Active Directory?

You can go to the AD settings in ISE to see which domain controller this ISE node is connected to. Also is this ISE node a standalone deployment?

Thanks,

Tarik Admani
*Please rate helpful posts*

Cisco ISE Sponsor Portal – Active Directory Login help.

Pongsatorn Maneesud — Fri, 03 Aug 2012 13:27:13 GMT

Have you try to add the Active Directory into the Sponsor_Portal_Sequence ?

Pongsatorn M.

Cisco ISE Sponsor Portal – Active Directory Login help.

Dominic Stalder (old profile) — Wed, 24 Oct 2012 10:59:19 GMT

Hi jrabinow

we have the same problem and I did have "local.dir" as AD identity store name. I changed this do something else without a dot (.), but it didn't work too.

Regards

Dominic

Cisco ISE Sponsor Portal – Active Directory Login help.

Pete Bauer — Wed, 24 Oct 2012 14:25:59 GMT

Can you post a screen cap of the Sponsors Group Policy Page?

Cisco ISE Sponsor Portal – Active Directory Login help.

Dominic Stalder (old profile) — Wed, 24 Oct 2012 14:29:25 GMT

Hi Pete

offcourse, here we go:

Best regards

Dominic

Cisco ISE Sponsor Portal – Active Directory Login help.

Pete Bauer — Wed, 24 Oct 2012 14:33:04 GMT

Ok - Under Settings->Sponsor->Authentication Source

What is the Identity Store Sequence set to?

Re: Cisco ISE Sponsor Portal – Active Directory Login help.

Dominic Stalder (old profile) — Wed, 24 Oct 2012 14:36:21 GMT

Sure:

Cisco ISE Sponsor Portal – Active Directory Login help.

Dominic Stalder (old profile) — Fri, 26 Oct 2012 21:03:53 GMT

Hi Pete

have you been able to solve your problem in the meantime?

Regards

Dominic

Cisco ISE Sponsor Portal – Active Directory Login help.

Dominic Stalder (old profile) — Sat, 03 Nov 2012 12:43:15 GMT

Problem or Bug seems to be solved in ISE 1.1.2.145, tried it today and it looks much better.

Best regards

Dominic

Cisco ISE Sponsor Portal – Active Directory Login help.

Evan Wheatley — Fri, 09 Nov 2012 00:04:06 GMT

Hi Pete,

Have you had any luck at all? I'm experiencing the same symptoms when trying to authenticate sponsors that are a member of a specific group in AD.

Regards,

Evan.

Cisco ISE Sponsor Portal – Active Directory Login help.

Evan Wheatley — Fri, 09 Nov 2012 00:06:09 GMT

I'm on 1.1.2.145 and still having problems

Re: Cisco ISE Sponsor Portal – Active Directory Login help.

Dominic Stalder (old profile) — Fri, 09 Nov 2012 06:03:48 GMT

Can you maybe post the different settings (AD profile, identity source profile, sponsor authorization)?

Thanks and regards

Sent from Cisco Technical Support iPhone App

Cisco ISE Sponsor Portal – Active Directory Login help.

Evan Wheatley — Wed, 14 Nov 2012 00:12:45 GMT

attached

Cisco ISE Sponsor Portal – Active Directory Login help.

Dominic Stalder (old profile) — Wed, 14 Nov 2012 07:27:56 GMT

I think the problem is, that you specify the ISE Identity Groups (SponsorAllAccounts, SponsorGroupAccounts and SponsorOwnAccounts) in the Sponsor Group Policy. Because all the AD users that should have access, are ONLY in the DC1:ExternalGroups, so you should allow ANY as Identity Group and DC1:ExternalGroups ..., see below:

Hope this will help you solve the problem.

Regards

Dominic

Cisco ISE Sponsor Portal – Active Directory Login help.

Evan Wheatley — Wed, 14 Nov 2012 16:38:48 GMT

Thanks for your help Dominic, unfortunatley I'm still getting the same..

The authentication in ISE is showing "Sponsor authentication has failed : Sponsorgroup not found for user" and the error on the sponsor portal is "Invalid sponsor group. Please try again."

Some more screengrabs