topic Re: ISE API Question in Network Access Control

ISE guest API Question enabled field

amakarenkov — Thu, 08 Jun 2017 13:34:09 GMT

Greetings!

When I create user using ERS API using:

<?xml version="1.0" encoding="UTF-8"?>

<ns0:guestuser xmlns:ns0="identity.ers.ise.cisco.com" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:ns1="ers.ise.cisco.com" xmlns:ers="ers.ise.cisco.com" description="What the heck is this" id="useless fields" name="why do even I type here">

<customFields>

</customFields>

<guestAccessInfo>

bla bla

</guestAccessInfo>

<guestInfo>

<enabled>true</enabled>

bla bla

</guestInfo>

bla bla

</ns0:guestuser>

I recieve the user with the(I checked with Get-By-Id):

<guestInfo>

<enabled>false</enabled>

</guestInfo>

The question is why?

I find it frustrating to enable the user with update query.

Thanks.

P.S. Also I dont get it why do I neet to put validDays even if I use fromDate with toDate fields.

halp!

Re: ISE API Question

amakarenkov — Fri, 09 Jun 2017 06:48:39 GMT

Hi, George!

2.2.0.470 ova eval

Re: ISE API Question

Jason Kunst — Fri, 16 Jun 2017 13:54:19 GMT

I spoke to developer about the Enabled.

He said this is only used in Get Operation to check if an account is active "true", an account is active after the user logs in or if under the guest type the bypass guest portal option is selected

The value will be false if account is denied (sponsor approval), expired or suspended

There is no way to set the state of this flag. and opened defect CSCvf36827 to have it hidden.

Re: ISE API Question

amakarenkov — Fri, 16 Jun 2017 14:27:35 GMT

Dear Jason,

thank you very much for your answer. Just to be clear can you clarify:

1. Is that possible to create a Guest user that will be enabled by default (using POST query)?

2. If YES. Is that correct, that this user will be enabled from the date I specify in fromDate field?

3. If YES. Considering those 2 facts will it be correct to say, that even if I create the guest user and with get operation I will get <enabled>false</enabled> despite this in fact guest is enabled and account is usable without any additional changes?

Also can you please tell what is correct math behind validDays with fromDate and toDate fields?

1. What is corect validDays value if I will put fromDate 06.16.2017 00:00 and toDate 06.16.2017 23:59

2. What is corect validDays value if I will put fromDate 06.16.2017 00:00 and toDate 06.17.2017 00:00

3. What is corect validDays value if I will put fromDate 06.16.2017 00:00 and toDate 06.18.2017 00:00

Thank you for any response!

Best regards,

Anton Makarenkov

Re: ISE API Question

Jason Kunst — Fri, 16 Jun 2017 14:32:43 GMT

can you please separate your questions, lets work on this here and move the other one to new post

1. Is that possible to create a Guest user that will be enabled by default (using POST query)?

JAK - you will need to make the guest type you're using have the setting enabled for bypass portal

2. If YES. Is that correct, that this user will be enabled from the date I specify in fromDate field?

YES

JAK - refer to #1

Re: ISE guest API Question enabled field

Jason Kunst — Tue, 08 Aug 2017 17:19:30 GMT

FFrom development I don’t think validDays is required if usefromDate/ toDate is already provided

if sill an issue please open defect

Re: ISE API Question

simolor78 — Thu, 10 Jan 2019 16:06:01 GMT

Hi all.

In ISE vers 2.2 when you create a GUEST USER by using POST the user is already ENABLED by default. I'am wondering if it's possible to create Guest users disabled and eventually enable them later.

Thank you

Re: ISE API Question

simolor78 — Thu, 10 Jan 2019 16:07:20 GMT

Hi all.

In ISE vers 2.2 when you create a GUEST USER by using POST the user is already ENABLED by default. I'am wondering if it's possible to create Guest users disabled and eventually enable them later.

Thank you

Re: ISE API Question

Jason Kunst — Thu, 10 Jan 2019 16:10:04 GMT

No just like the sponsor portal you have to create an account that’s enabled right away (from first login) or do a start time.

How about deactivating (expiring or locking them) then reinstating? Remember the guest purge can’t run when then are deactivating