Lobby Ambassador TACACS denied to create Guest Users

[Paul Freiberg]

Hi,

I read some threads but I found no answer.

I use WCS 7.0.172.0 an ACS 5.2

I configured in ACS a Shell Profile for Lobby Ambassador Accs like I did for Admins.

If I login as such lobby ambassador, I see just what i have to see. But if i'm going to create a guest user I got the message:

Permission Denied

You do not have privileges for the requested  operation.

After Forum reading I created a local user with exact the same name, differnt pw, with no success.

The shell profile:

role0 | mandtory | LobbyAmbassador

task0 | mandtory | Configure Guest Users

task1 | mandtory | Lobby Ambassador User Preferences

Thx 4 reading!

btw: I just can authenticate with tacas+/pap, if I configure chap I've got a failure. chap is allowed in ACS...

[Paul Freiberg]

OK I fixed it.

I had to add:

virtual-domain0 | mandatory | root

to the top of the shell profile, like described in:

http://www.cisco.com/en/US/docs/wireless/wcs/7.0/configuration/guide/7_0admin.html
now it works...

The WCS "Task List" output of the group hasn't list it...

But the CHAP probleme still wasn't fixed. Anyone who use TACACS/CHAP auth?