ISE 1.3 Sponsored Guest Portal Login Failure

[Bilal Nawaz]

Hello Team,

Ive created a guest account in the sponsor portal for a test guest user, however the state remains in "created" state.

Now when the user tries to log on via the sponsored guest portal the error back is "invalid username or password".

In ISE logs it says :

Overview

Event	5418 Guest Authentication Failed
Username	bnawaz01
Endpoint Id
Endpoint Profile
Authorization Result

Authentication Details

Source Timestamp	2014-12-24 08:49:05.551
Received Timestamp	2014-12-24 08:49:05.553
Policy Server	DC1-ISE-DMZ01
Event	5418 Guest Authentication Failed
Failure Reason	Account is not yet active.
Resolution
Root cause
Username	bnawaz01
User Type	GuestUser
Endpoint Id
Endpoint Profile
IP Address
Authentication Identity Store	Guest Users
Identity Group	GuestType_Contractor (default)
Audit Session Id
Authentication Method	PAP_ASCII
Authentication Protocol	PAP_ASCII
Service Type
Network Device
Device Type
Location
NAS IP Address
NAS Port Id
NAS Port Type
Authorization Profile
Posture Status
Security Group
Response Time

Any ideas why this might be, if im doing something wrong and how to fix?

Thank you

Bilal

[mohanak]

Conditions:
Guest uses a timeProfile fromFirstLogin and didn't logged in before timeProfile validity time

Workaround:
Reset Guest account validity from Sponsor portal fixes the issue temporarily (the same situation will occur if guest do not login).

[mick_johnson@hotmail.com · Accepted solution]

I have had the same issue, the fault is caused by the time zone in the sponsor groups being set by default to UTC, so if you are in London the accounts wont become available until UTC time. The best practice is to add a local time zone and remove UTC at initial configuration

To resolve this create a new local time zone in Guest Access>Settings>Guest Locations and SSIDs then under Guest Access>Configure>Sponsor Groups amend the time zone properties in each sponsor group

One other problem is if you do not remove this at initial configuration you don't seem to be able to get rid of UTC, not really an issue unless you forget when creating new sponsor groups

[Mathieu LASSERRE]

I confirm, it's the solution.

Well done.

[mick_johnson@hotmail.com]

The issue is caused by incorrect time zone all goes back to when the ISE was first installed and you select the wrong time zone there, eg if in UK you select UTC instead of GB (best to select GB).

When you create your guest portal and use UTC time zone as your local time there is an hours difference so when you create the user account it sees it as not active yet, if you wait an hour you would then be able to log in. I usually use London and remove the default time zone from the portal.

[PAUL GILBERT ARIAS]

Hello,

I am having the same problem but the difference is that I have ISE 2.0. I already did the recommendations and still get the same situation.

My ISE is using NTP as the time source and shows the correct timezone. I edited the Guest Locations and SSIDs parameters to match the correct timezone.

The guest tries to self-register, gets the username and password but when he tries to log in the authentication fails and I receive the log message saying that the account is not yet active.

I don't know what else to try.

Any ideas?

[PAUL GILBERT ARIAS]

I was able to resolve my problem. I had to go to Guest Locations and SSIDs and leave the default setting for San Jose. Instead of using my local timezone I used UTC. Don't know why this solved the problem but it did.

[Venkatesh Attuluri]

Have you checked the identity source sequence

[Mathieu LASSERRE]

Hello,

Have you found a solution about your issue ??

thx

regards.