Lobby Admin not able to create a users account

[patrickroberts]

Hi All

Strange issue with our Guest Lobby admin account, when logged into the 9800-80 Lobby account i click to create a new users and filling in all details (see below)

But keep getting the error message "Invalid input detected at ^ marker 

anyone had this ?

current version 17.9.6

[marce1000]

    - Could be a GUI-bug ; try the CLI equivalent of the command,

 M.

[patrickroberts]

Do you have the CLI commands i can see how to create a Lobby Admin account users but not a guest users ?

It seems a big issue not to be able to do it via the GUi as it is designed to for a lobby Admin staff to give Guest wifi out 

[marce1000]

   >.....Do you have the CLI commands i can see how to create a Lobby Admin account users but not a guest users ?
 Ref : https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-2/config-guide/b_wl_17_2_cg/lobby_admin_accounts.html#info-about-lobby-ambassador-account
        >...A global administrator can create a lobby ambassador (lobby admin) user for creating guest users.
  The above being the sole purpose of the Lobby Admin account.

    >Do you have the CLI commands 
     FYI : https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-2/config-guide/b_wl_17_2_cg/lobby_admin_accounts.html#create-a-lobby-ambassador-account-commands

  Since 17.9.x is EOL , I would advice to go for 17.12.4 and try again ; you could for instance deploy that version as a VM for testing    (cloud controller can always be downloaded for free)

  M.

[patrickroberts]

yes have seen this on how to create a Lobby Admin but not users on CLi.

in my lab i have it working ok for 17.12.3 but 17.9.6 is MD and nothing in the notes about this bug .

There was about not able to access the Lobby account login in 17.9.3 etc but nothing for adding a Guest , i would have thought others would have had the same unless the lobby Guest feature isn't used much, its just needed for a temp fix.

Upgrading to 17.12.X is a last resort with over 900 + Aps on site its not a task we take likely. 

[marce1000]

               >...Upgrading to 17.12.X is a last resort with over 900 + Aps on site its not a task we take likely. 
  I agree , plan carefully ; yet consider https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-xe-17/ios-xe-17-9-x-eol.html

 M.

[MHM Cisco World]

I am also thinking it bug' unless you access the GUI with level not 15 (admin) that case you can not add this user

MHM

[patrickroberts · Accepted solution]

Hi all this is now fixed and working 

I had to change the below to make it work correctly:

The AAA_LOGIN_LIST is used for both authentication and authorization:

aaa authentication login AAA_LOGIN_LIST local group TACACSGROUP

aaa authorization exec AAA_LOGIN_LIST group TACACSGROUP local

For authentication the first option is local, after that using a tacacs group. But in the case of the authorization, the group is first, local second.

Makes sense to see that the user is able to access (authentication) but then, unable to configure (authorization). 

It was necessary to change the aaa line and use this one:

aaa authorization exec AAA_LOGIN_LIST local group TACACSGROUP