Cisco ISE Sponsor Portal – Active Directory Login help.

[Pete Bauer]

Hello,

We’re trying to setup our Sponsor Portal to query an Active Directory group for login credientials and having some trouble. Right now we’re receiving the error, “Sponsor authentication has failed : Sponsorgroup not found for user”

Is there a configuration guide available explaining how to configure this?

Any help would be great.

Thanks,

Pete

[Tarik Admani]

Pete,

Give this a try and see if this gets you rolling - http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_guest_pol.html#wp1096365

Thanks,

Tarik Admani
*Please rate helpful posts*

[Pete Bauer]

I have that configured per the link you provided.

I'm still recieving the following error, "Sponsor authentication has failed :  Sponsorgroup not found for user"

I have an authorization policy setup however I don't think it's even making it that far.

Thanks,
Pete

[jrabinow]

Do you see in the authentiaction details which AD groups were retrieved?

One suggestion. I see that the name you have given to the AD store is AD_washcty.local. May be worth trying a name that does not include a '.' character

[Pete Bauer]

Does this screen cap help?  There is no Identity Group associated with the login request.

We've used 'AD_washcty.local' with all our other AD based authentication on ISE without issue.

Thanks again,

Pete

[Tarik Admani]

Pete,

That is interesting. Can you can post a screenshot of the "memberOf" section of this user account in Active Directory?

You can go to the AD settings in ISE to see which domain controller this ISE node is connected to. Also is this ISE node a standalone deployment?

Thanks,

Tarik Admani
*Please rate helpful posts*

[Dominic Stalder (old profile)]

Hi jrabinow

we have the same problem and I did have "local.dir" as AD identity store name. I changed this do something else without a dot (.), but it didn't work too.

Regards

Dominic

[Pete Bauer]

Can you post a screen cap of the Sponsors Group Policy Page?

[Dominic Stalder (old profile)]

Hi Pete

offcourse, here we go:

Best regards

Dominic

[Pete Bauer]

Ok -  Under Settings->Sponsor->Authentication Source

What is the Identity Store Sequence set to?

[Dominic Stalder (old profile)]

Sure:

       

[Dominic Stalder (old profile)]

Hi Pete

have you been able to solve your problem in the meantime?

Regards

Dominic

[Evan Wheatley]

Hi Pete,

Have you had any luck at all? I'm experiencing the same symptoms when trying to authenticate sponsors that are a member of a specific group in AD.

Regards,

Evan.

[Pongsatorn Maneesud]

Have you try to add the Active Directory into the Sponsor_Portal_Sequence ?

Pongsatorn M.

[Dominic Stalder (old profile)]

Problem or Bug seems to be solved in ISE 1.1.2.145, tried it today and it looks much better.

Best regards

Dominic