topic Re: If self-registration user coincide with an AD user name, login fai in Network Access Control

If self-registration user coincide with an AD user name, login fail

morabusa — Tue, 16 Nov 2021 10:17:34 GMT

Hi,

We have a Guest WLAN with CWA using a self-registering portal with sponsors, and if clients create a username which already exists on AD, the login fails because the ISE tries to authenticate the user with the AD, even when I have only specified "Internal Users" in the sequence. Is there a way to make work this scenario when the self-registered user name coincide with a current existing AD user?

EDIT: Adding more information, lets supose that there is a user called John Smith, then we have a username created in the AD called jsmith. Then the same user wants to register in the self-register portal specifying his first name and last name, and the ISE also tries to generate a new username called jsmith. Then when the user tries to log in to the Guest WLAN, it fails because AD domain is not included in the identity source sequence for Guest access (due to a internal company policy).

Thanks.

Re: If self-registration user coincide with an AD user name, login fai

thomas — Fri, 10 Dec 2021 04:59:02 GMT

The ISE guest user database is internal to ISE and completely separate from AD.

ISE cannot create users in AD.

Please show us the actual ISE LiveLog Details from the failure so we can see the reason Why if fails according to ISE.

It would potentially help to see what your Guest Authorization Rules are in your ISE Policy Set in case you messed with the default ones.

Re: If self-registration user coincide with an AD user name, login fai

morabusa — Fri, 10 Dec 2021 07:28:27 GMT

Thanks Thomas. It was a missconfiguration, in the Identity source sequence I placed internal users over the guest users, and we had these users internally defined (but with AD authentication) in the ISE Identity. Thanks for the help.