topic Re: ISE 3.1 single click guest approver not matching email address in Network Access Control

ISE 3.1 single click guest approver not matching email address

laposilaszlo — Thu, 01 Feb 2018 09:06:04 GMT

Hello Everyone,

I am having the following problem with ISE 3.1 single click guest approval.

Our AD usernames look like this: john_doe

Emails look like this: john.doe@company.org

Now a guest user self-registers and at the person beeing visited he enters john.doe@company.org

John Doe receives the email and approves it by clicking the link.

All is good and the guest users has now access.

But when John Doe logs in to the sponsor interface using AD credentials in the format john_doe he doesn't sees the users he approved.

And the problem is that the users he approved, have john_doe@company.org at sponsor field. (this john_doe@company.org is not AD username and not even email, but a combination of both.)

And john_doe@company.org cannot log in to sponsor portal. This format of username is not accepted by the portal.

So probably the question is, when the sponsor clicks the approve link, can that guest user be associated with the sponsor AD user name(or in worst case his email address)?

Thanks,

laszlo

Re: ISE 3.1 single click guest approver not matching email address

Jason Kunst — Thu, 01 Feb 2018 12:16:53 GMT

I believe they have accounted for this as a bug

Since it seems you are running into this on ISE 2.1 (there is no 3.1) make sure you’re on the latest patch. It may require moving to 2.2 with latest patch

Reach out to the tac as well to advise on issue because has come up before

Re: ISE 3.1 single click guest approver not matching email address

laposilaszlo — Thu, 01 Feb 2018 12:25:00 GMT

Hi Jason,

I am glad that you noticed my post, you seem to know your way around guest and portals.

I am running v 2.3 no patch. (3.1 was a typo.)

Do you know if there is a bug id for this that i can track or reference in the TAC case?

Thank,

laszlo

Re: ISE 3.1 single click guest approver not matching email address

Jason Kunst — Thu, 01 Feb 2018 12:40:42 GMT

The tac would be able to help with that

Seems like a bug