Cisco 9800-L-C running IOS XE 17.15.5, using Cisco ISE 3.4 for TACACS+. AAA is working flawlessly for SSH authentication and authorization, good logs on both sides. When I change from local to AAA for IP HTTPS secure-server, the webgui fails to load, giving the Openresty error page. ISE logs show successful authentication and authorization entries with authorization response {Author-Reply-Status=PassAdd; AVPair=priv-lvl=15; } giving the correct privilege level 15. If a wrong password is entered, the webgui responds with a failed authentication message and returns to logon prompt. Is something acting wrong or did I miss an additional config change needed to make AAA work with the webgui?
Working local auth config:
ip http authentication local
Fails when I configure for TACACS:
aaa authentication login NAME group GROUP local
aaa authorization exec NAME group GROUP local
ip http authentication aaa login-authentication NAME
ip http authentication aaa exec-authorization NAME
TACACS debug from switch returns:
May 1 17:09:49.990: %SEC_LOGIN-5-WEBLOGIN_SUCCESS: Login Success [user: USERNAME] [Source: xx.xx.xx.xx] at 12:09:49 CST Fri May 1 2026
May 1 17:09:49.991: %WEBSERVER-5-LOGIN_PASSED: Chassis 2 Login Successful from host xx.xx.xx.xx by user 'USERNAME' using crypto cipher 'TLS_AES_256_GCM_SHA384'
Failure message when trying webgui with AAA:
An error occurred.
Sorry, the page you are looking for is currently unavailable.
Please try again later.
If you are the system administrator of this resource then you should check the error log for details.
Faithfully yours, OpenResty.
