topic Re: Guest Single Sign-on with LDAP in Network Access Control

Guest Single Click with LDAP

paul — Fri, 21 Jun 2019 15:01:58 GMT

I am doing a guest install where the guest PSNs are not joined to AD and we are using LDAP. We have an group mapped into to the sponsor role and the users can log into the sponsor portal without an issue using their account name (JDoe4567 as an example). The user's email address is jdoe@customer.com. Because they are doing O365 they have changed all their UPNs to jdoe4567@customer.com. The only LDAP attribute that has the email address in it is the Mail attribute.

When the guest enters jdoe@customer.com in as the person they are visiting the sponsor receives an email but has to sign into the portal which means the single click process didn't work. We set this up in a lab as well and changed the UPN to jdoe@customer.com and single clicked worked perfectly.

Is ISE only looking up the UPN attribute when it does the single click look-up based on the email address?

Re: Guest Single Sign-on with LDAP

paul — Fri, 21 Jun 2019 15:01:32 GMT

An update, we turned on some debugs and we can see in the guest.log that the email lookup is working against LDAP but it says no groups are received. The same account though works when we sign into the sponsor portal so LDAP groups are working there.

Re: Guest Single Sign-on with LDAP

Jason Kunst — Mon, 24 Jun 2019 20:53:51 GMT

I reached out to engineering, did you get a tac case opened?

Re: Guest Single Sign-on with LDAP

paul — Mon, 24 Jun 2019 20:57:51 GMT

Not yet. We did some more debugging on the issue and can't get consistent results. We tried both LDAP group membership and using LDAP attributes to assign sponsor roles.

We will be opening a TAC case this week. The single click approval is a nice to have for the customer. We are working through other issues so we can start a pilot. We can do the pilot without single click working.

Re: Guest Single Sign-on with LDAP

Jason Kunst — Fri, 28 Jun 2019 15:33:58 GMT

they said need logs go through tac please