Not sure if this will help...
We were having the same issue when guest users were redirected to the quest portal. What was happening in our environment was that we implemented a wildcard SSL certificate so that user's wouldn't get the "unsecure connection" warning when they were presented with our internal CA certificates.
In order to do this, we had to change the URL presented to users; which was different than the FQDN of the ISE hosts (2 different domains). At first we were doing Round Robin DNS to perform this.
This was our issue. Upon the guest user's first connection to the open SSID, the WLC and ISE would talk between each other (WLC <--> PSN 1). However, when user's were authorized and redirected to the portal it would be a different node (User <--> PSN 3). This meant the session IDs were different and thus user's would get that error.
This is what TAC had us perform to fix the issue:
http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/117620-configure-ISE-00.html
The only down side is that the PSNs aren't really "load balanced" all clients will be directed to a single PSN until that PSN goes down. Then all requests will go to the next PSN in the cluster.
Hope that helps.
