Cannot login to WLC 9800 GUI using Radius

[Moudar]

Hi,

We are currently using RADIUS (ISE) for authentication, and while we can successfully log into the CLI of our Cisco 9800 via the AAA server, we encounter a "Wrong Credentials. Please Login again." message when attempting to log into the GUI.

The logs on ISE indicate "5200 Authentication succeeded."

For reference, logging into the GUI using a local account works without any issues.

WLC#sh run | in http
ip http server
ip http secure-server
  destination transport-method http

so any ideas?

[Mark Elsen]

 - Do you have the radius server configured to return av pair with priv levels 15 ?

 M.

[Moudar]

do we need to add anything else ? for web auth.

[Moudar]

It works now adding "aaa authorization exec default group RADIUS_AUTH" to the aaa configuration

I don't realy understand why adding that line would allow aaa to GUI, when login to CLI it goes directly to #mode

[Rich R]

You should have a good read through https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214490-configure-radius-and-tacacs-for-gui-and.html

[Moudar · Accepted solution]

This configuration works well:

aaa authentication login default group RADIUS_AUTH local line
aaa authentication dot1x default group RADIUS_AUTH
aaa authorization exec default-web group RADIUS_AUTH local
aaa authorization network default group RADIUS_AUTH
aaa accounting exec default start-stop group RADIUS_AUTH
 
ip http authentication aaa login-authentication default
ip http authentication aaa exec-authorization default-web

It needed to understand the concept of "Method lists"