ISE - 5400 Authentication failed - Username:USERNAME

[Mcolak001]

Since the username in the Authentication Details is "USERNAME", I get a "Invalid username or password specified" warning and I can't log in with my existing local accounts.

Why does the username come up like this?

username:USERNAME

[Rob Ingram]

@Mcolak001 the username is invalid and not in the identity store, so ISE does not reveal the usernames.

EDIT: You can disable this if you navigate to Administration > Settings > Security Settings > Disclose invalid usernames and select the checkbox.

[Mcolak001]

Hi Rob,I guess it is not valid in my version.

3.1.0.518

 

[Rob Ingram · Accepted solution]

@Mcolak001 sorry it's under Administration > Settings > Security Settings > Disclose invalid usernames. 

[Mcolak001]

Very good suggestion. Now I can see the usernames. Thank you.

Now I can analyze the problem better.

Do you have any comments about this problem?

  

[Rob Ingram]

@Mcolak001 is this "test-user" account a local account on the PC itself? ISE won't be able to authenticate that user, as it won't be able to perform a lookup.

I've never tried it but perhaps you create a "test-user" account in the ISE local userstore and lookup user requests to that. Although that is not a practical solution.

[Mcolak001]

yes, local user.

Is it normal for the authentication policy to be default when it is via a third party device (non cisco)?

 

[Rob Ingram]

@Mcolak001 do you have other Policy Sets (other than the default)? If yes, the connection request is not matching your other Policy Set and hitting the Default Policy Set. Check your conditions on the other policy set, amend accordingly.

[Mcolak001]

Hi Rob,

I saw where it got stuck in the logs.

I had to make these changes to the authentication policy. and it works now.

thank you.