Cisco ISE and guest user API error

[trondaker]

Trying to get all guest users listed in an API-call, but the API responds with: com.cisco.cpm.guestaccess.apiservices.exception.PortalSystemException: Sponsor users sponsor groups are not available any more"

The API-call that throws me this error is:

host = "1.1.1.1"
user = "user"
password = "passord"

conn = http.client.HTTPSConnection("{}:9060".format(host), context=ssl.SSLContext(ssl.PROTOCOL_TLSv1_2))

creds = str.encode(':'.join((user, password)))
encodedAuth = bytes.decode(base64.b64encode(creds))

headers = {
'accept': "application/json",
'content-type': "application/json",
'authorization': " ".join(("Basic",encodedAuth)),
'cache-control': "no-cache",
}

conn.request("GET", "/ers/config/guestuser", headers=headers)

res = conn.getresponse()
data = res.read()

print(data)

Running 3.1 patch 9 - same issue here:

https://community.cisco.com/t5/network-access-control/ise-2-4-guest-api-error/td-p/4129662

According to the API-doc this should work?

[trondaker]

Ops, wrong category

[marce1000]

  - @trondaker I moved it to the correct group , 

 M.

[bigevilbeard]

@trondaker there is an example here https://developer.cisco.com/docs/identity-services-engine/latest/get-all-guest-users/#execution - if you share the error message this would help narrow down your issue.

Hope this helps.

[trondaker]

Ran the exact same code as the link above, replaced username/pass/host and got the following:

Body:
{
"ERSResponse" : {
"operation" : "GET-getAll-guestuser",
"messages" : [ {
"title" : "com.cisco.cpm.guestaccess.apiservices.exception.PortalSystemException: Sponsor user's sponsor groups are not available any more",
"type" : "ERROR",
"code" : "CRUD operation exception"
} ],
"link" : {
"rel" : "related",
"href" : "https://x.x.x.x:9060/ers/config/guestuser/",
"type" : "application/xml"
}
}
}

[bigevilbeard]

@trondaker It looks like the script executed successfully, but the response from the server indicates an error, as you see. 

It looks like server is indicating that the sponsor user's sponsor groups are no longer available, which is preventing the retrieval of guest users. You may need to investigate why the sponsor groups are no longer available or update the script to handle this error scenario.

Hope this helps.

[trondaker]

Hi again @bigevilbeard !
I logged on to the sponsor portal and checked the sponsor-field, and it is empty for all accounts. This might be what the API is referring to, but im kind of lost as to how to retrieve all guest users when this field is empty? There seems to be no other way then theGET", "/ers/config/guestuser"-path. I tried to iterate through all users to set the sponsor-field, but i cant see a way to it. Any tips? Is there a way to delete all users, to start fresh? From the portal i would have to delete 10 users at a time, that would take forever. 

[bigevilbeard]

@trondaker hmm so i guess you could update sponsor field for each guest user through the sponsor portal, however, as you mentioned, this can be a time consuming process.. I think you might be able to do this with the API, try he PUT /ers/config/guestuser/{id} and update a guest users information, which should include the sponsor field, your code will  need to iterate through each guest user and update the sponsor field here.

I dont know if there is a bulk delete endpoint in the ISE API. I would use the DELETE /ers/config/guestuser/{id} and delete individual guest users this way using a script to iterate through each guest user and delete them one by one, again this would still be a time consuming process, but it might be faster than doing it manually through the portal.

Hope this helps.

[trondaker]

Thanks, ill try - but when iterating over the ids, is there any way to get those ids besides the call that doesnt work? 

[bigevilbeard]

You might try and use the API endpoint to retrieve a list of all users (not just guest users) and then filter out the non-guest users? It might not be affected by the PortalSystemException since it's not specific to guest users too, but thats a guess here.

Hope this helps.