Cisco ISE Sponsor Portal – Active Directory Login help.

[Pete Bauer]

Hello,

We’re trying to setup our Sponsor Portal to query an Active Directory group for login credientials and having some trouble. Right now we’re receiving the error, “Sponsor authentication has failed : Sponsorgroup not found for user”

Is there a configuration guide available explaining how to configure this?

Any help would be great.

Thanks,

Pete

[Evan Wheatley]

I'm on 1.1.2.145 and still having problems

[Dominic Stalder (old profile)]

Can you maybe post the different settings (AD profile, identity source profile, sponsor authorization)?

Thanks and regards

Sent from Cisco Technical Support iPhone App

[Evan Wheatley]

attached

[Dominic Stalder (old profile)]

I think the problem is, that you specify the ISE Identity Groups (SponsorAllAccounts, SponsorGroupAccounts and SponsorOwnAccounts) in the Sponsor Group Policy. Because all the AD users that should have access, are ONLY in the DC1:ExternalGroups, so you should allow ANY as Identity Group and DC1:ExternalGroups ..., see below:

Hope this will help you solve the problem.

Regards

Dominic

[Evan Wheatley]

Thanks for your help Dominic, unfortunatley I'm still getting the same..

The authentication in ISE is showing "Sponsor authentication has failed : Sponsorgroup not found for user" and the error on the sponsor portal is "Invalid sponsor group. Please try again."

Some more screengrabs

[Dominic Stalder (old profile)]

Very strange. Do you have a special character in the Domain Name or the Identity Store Name?

[Evan Wheatley]

Just a hypen in the Identity Store, the format of the name is ABC-DC1. The domain name is simple; domain.com.

[Tarik Admani]

Check the additional attribute section in the report and see if the AD group is being retrieved for this user.

Thanks,

Tarik Admani
*Please rate helpful posts*

[Evan Wheatley]

Thanks for your help Tarik, but still no luck.

I might try stripping it all back, and re-added.

I'll report back if I have any progress.

[Evan Wheatley]

I've been able to get it working now, I removed the groups I was originally trying to use - tried a different one that was newly created with the same users added to it - and voila.. it works.

thanks Dominic and Tarik for your help.

[Dominic Stalder (old profile)]

Hi Evan

thanks for your feedback.

Regards

Dominic

[Dominic Stalder (old profile)]

OK, then I don't have any more ideas, why the problem occurs. At the moment, I have a lot of other problems / bugs / questions open concerning ISE guest / sponsor portal.

[David Niemann]

I'm having the same issue on 1.1.2.145, when I changed the Identity group to Any it worked.

[manjeets]

Kindly review the below link:

https://www.cisco.com/en/US/docs/solutions/Enterprise/Security/TrustSec_2.0/trustsec_2.0_dig.pdf