Cisco ISE: Sponsor decide duration by Approval

[User42]

Hi everyone

Is there a way that the Sponsor can decide for how long a guest accounts is active by approval?

1. Guest Register himself with the Guest Portal (also with an E-Mail Address from a Sponsor)

2. The Sponsor gets an E-Mail.

3. By Clicking on the link, the Sponsor can decide that this account is active for x days (Based on his ad Group)

(Example: Sponsor from AD Group A: Can approve accounts from 1-30 days, Sponsor from AD Group B: Approve Accounts from 1-5 days)

Thanks in advance!

[Arne Bier · Accepted solution]

The Sponsor Approval workflow is not flexible enough to allow that. Every self-registered visitor will always be assigned to the same Endpoint Identity Group. That means you should consider which Endpoint Identity Group to use as the lowest common denominator for self-registration visitors (e.g. 5 days), and then leave the special cases to Sponsor created accounts (e.g. 30 days). Ultimately, duration of visit is determined by the existence of a MAC address in the Endpoint Identity Group, and the Endpoint Purge Rule will clear out addresses when the time is up.

[Aref Alsouqi · Accepted solution]

As @Arne Bier mentioned, there is no way to achieve what you are trying to do, approving the guest accesses via the approver received emails is just a link to allow or reject that approval request.

The guest duration along side other attributes such as how many simultaneous logins, maximum devices that can register etc are dictated by the guest type you associate to the portal, and that is a unique value to all the guest users that will register through that portal. By default there are three types, Daily, Weekly, and Contractor, you can create your own customer guest type if needed.