topic Re: Guest username cannot contain comma (doc issue?) in Network Access Control

Guest username cannot contain comma (doc issue?)

masyamad — Wed, 03 Oct 2018 00:50:39 GMT

Hi dev team,

ISE2.4 administration guide shows username doesn't accept "<, >, /, and %" as special character.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01111.html#concept_1C033A7699A24911ABAC796512681A3B

> The special characters <, >, /, and % cannot be used.

But ISE GUI doesn't accept comma. It shows "can not contain <, >, /, %, space or comma"

This seems that admin guide is outdated. Could you check it?

And I found 1 BugID which is related to Guest username.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvm68714/

According to the BugID, the username should contain space

(even though GUI shows space cannot be contained)

So now I'm not sure what characters are really supported on ISE guest.

I'd appreciate if you clarify about the point and update admin guide properly.

Re: Guest username cannot contain comma (doc issue?)

Nidhi — Wed, 03 Oct 2018 06:57:45 GMT

Thanks for bringing this up.

We will take it to the documentation team !

Thanks,

nidhi

Re: Guest username cannot contain comma (doc issue?)

masyamad — Wed, 03 Oct 2018 09:37:02 GMT

Hi Nidhi,

Thanks. I look forward to the doc update. Please also tell me if permitting space for username is really expected by design.

BTW now I'm facing similar issue on username of network access user. Please also check it.

Guide shows "Do not include space, +, and * characters in the username."

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01110.html#ID113

But ISE GUI shows more characters (but doesn't introduce space as unsupported character)

This also makes supported character unclear. Please tell me real supported characters for the network access user.

BTW I also found the user whose name contains space will not be modified/deleted via admin GUI.

I'd like to know if the behavior is either of following.

1) It's deleting problem. ISE should handle deleting " " user.

2) It's user creating problem. ISE should deny creating " " user.

Thanks for your support.

Re: Guest username cannot contain comma (doc issue?)

masyamad — Tue, 09 Oct 2018 08:20:33 GMT

Hi, utf-8 support for guest username is also unclear. Could you also clarify?

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01.html#ID431

The guide mentions about guest password.

> Cisco ISE does not support guest passwords with UTF-8 characters.

And also mentions about all fields for guest portals.

But it doesn't mention about username.

* Above table shows all fields in sponsor/guest/my devices portal supports utf-8, but there is no username field on guest/my devices portal. It will be dynamically generated by first/last name, or statically specified via ERS API.

Can I think username for the network access user also supports utf-8?

Sorry, the topic became a bit complex. But in summary, now I'd like to know about the following table items.

Could you fill the table and correct items if something is wrong?

	utf-8 support?	unsupported characters
guest username	* Unknown	<, >, /, %, space, comma (and more? ex control characters?) * Space is unclear with CSCvm68714
guest password	No	<, >, /, and % (It's enough or more? control characters? )
network access user username	Yes	!, %, :, ;, ,, [, {, \|, }, ], `, ”, =, <, >, ? (space? or more?)
network access user password	Yes	control characters (crystal clear!)

Referenced information.

For guest username)

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01111.html#concept_1C033A7699A24911ABAC796512681A3B
> The special characters <, >, /, and % cannot be used.
Admin Portal
GUI shows "can not contain <, >, /, %, space or comma"

For guest password)

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01.html#ID431
> Cisco ISE does not support guest passwords with UTF-8 characters.
https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01111.html#concept_FF8145104F0742298F870657F5A5CD57
> The special characters <, >, /, and % cannot be used.

For network access user username)

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01.html#ID431
> User list: Values shown on the User List page (as UTF8 Field)
https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01110.html#ID113
> "Do not include space, +, and * characters in the username."
Admin portal
GUI shows "Name should not contain any of the following characters !%:;,[{|}]`”=<>?"

For network access user password)

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01.html#ID431
> User password policy (as UTF8 Field)
> Password field accepts any characters including UTF-8 characters, but it doesn't accept control characters.

Re: Guest username cannot contain comma (doc issue?)

Nidhi — Thu, 04 Oct 2018 05:10:44 GMT

Replied to you over email.

Thanks,

Nidhi

Re: Guest username cannot contain comma (doc issue?)

Nidhi — Tue, 09 Oct 2018 08:35:31 GMT

From the admin guide -

Network access authentication supports UTF-8 username and password credentials. This includes RADIUS, EAP, RADIUS proxy, RADIUS token, and web authentication from the Guest and Administrative portal login authentications. UTF-8 support for user name and password applies to authentication against the local identity store as well as external identity stores.

So the Guest Username supports utf-8.

regarding the missing character information ( Space, comma etc ) , the documentation team will gather information from the respective teams and update the document.

Re: Guest username cannot contain comma (doc issue?)

masyamad — Wed, 10 Oct 2018 23:12:17 GMT

Hi Nidhi,

Thanks for the update.

I checked the description, but it was still slightly unclear.

> UTF-8 support for user name and password applies to authentication against the local identity store as well as external identity stores.

The target of "UTF-8 support for user name and password" is not documented.

Do you mean it contains all of network access user, admin user, and guest user?

But if so, the description conflict following statement.

> Cisco ISE does not support guest passwords with UTF-8 characters.

BTW it's not so convenient that each explanation about username/password support is located on different section.

It would be really appreciated if the guide will have these information in 1 section or 1 table.