topic Re: Single Click Self-Registration Approval Link PSN Specific? in Network Access Control

Single Click Sef-Registration Approval Link PSN Specific?

paul — Thu, 15 Nov 2018 14:30:39 GMT

Is the single click self-registration link that is sent to sponsor in the email PSN specific? I mean can any PSN process that link?

I have a two node deployment where the sponsor portal has an FQDN, sponsor.mycompany.com. We have A records for sponsor.mycompany.com pointing at both ISE nodes. If ISE node #1 processes the self-registration and sends the email, but DNS resolves sponsor.mycompany.com to node #2, the link errors out saying it has expired. If it goes to node #1 it works just fine.

I have used this setup before many times (FQDN with multiple A records) and don't remember this issue.

I am going to test in my lab hopefully this week when I get time.

Re: Single Click Sef-Registration Approval Link PSN Specific?

ognyan.totev — Thu, 15 Nov 2018 14:44:18 GMT

I got same issue in my 2 node deployment. Thats why in Authorization i mark static redirection to 1 psn . And it never send to second .

Re: Single Click Sef-Registration Approval Link PSN Specific?

Jason Kunst — Thu, 15 Nov 2018 14:47:31 GMT

Static redirection is a different issue then the approval link. Static redirection to me should only be included for certain DMZ/DNS issues and perhaps poor load balancing manually. That’s a separate discussion.

Re: Single Click Sef-Registration Approval Link PSN Specific?

Jason Kunst — Thu, 15 Nov 2018 16:34:31 GMT

Paul and I working offline on this

Re: Single Click Self-Registration Approval Link PSN Specific?

paul — Fri, 16 Nov 2018 14:11:24 GMT

Okay I just tested this on a different customer and the approval link is not tied to a PSN (whew... I thought I was going crazy). There must be an issue with the 2nd PSN at the customer I saw this issue.

For your reference the Approval link looks like this:

https://sponsor.mycompany.com:8445/sponsorportal/PortalSetup.action?portal=af0e2960-c324-11e8-b505-6a8ec20f675a&oneClickToken=4Hm/OR0mv3/l/xnzMs7b5g==&oneClickAction=Approve

I tested by changing the link to a PSN that didn't do the guest registration:

https://psn05.mycompany.com:8445/sponsorportal/PortalSetup.action?portal=af0e2960-c324-11e8-b505-6a8ec20f675a&oneClickToken=4Hm/OR0mv3/l/xnzMs7b5g==&oneClickAction=Approve

Everything worked just fine. The only part of the string that changes from request to request is the oneClickToken value that isn't PSN specific. I believe, Jason correct me if I am wrong, the value is the encoded AD information of the person being visited.

Re: Single Click Self-Registration Approval Link PSN Specific?

Jason Kunst — Fri, 16 Nov 2018 16:14:58 GMT

Paul you're correct, the token is for the approval session authentication that includes the guest account