WCS Lobby Ambassador with AD credentials - editing guest defaults

[joseph.demaio]

Hi,

A client of mine recently requested that device authentication for everything is through RADIUS/AD for auditing purposes. As a result a specific AD group has been set aside for users with Lobby Ambassador permissions and it works great using the task list. The problem we've run into is that now these accounts are able to edit the guest account defaults and create users with no restrictions. Previously the shared Lobby Admin had the "defaults editable" field unchecked. Does anyone know how to duplicate that functionality for RADIUS authenticated users?

The following are the only task permissions returned by RADIUS:

role0=LobbyAmbassador

task0=Configure Guest Users

task1=Lobby Ambassador User Preferences

I've tried removing task1 but that is just the display preferences of the page.

Thanks

[algotsson]

Hi Joseph,

Did you find a resolution for this? We're experiencing the same behavior.

Also, it would be nice to define what defaults to be editable to enable lobby admins to schedule guest users in the future.

Thanks

Chris

[joseph.demaio]

Hi Chris,

Unfortunately we haven't any luck on our side. I'm trying to get a lab setup with NCS to see if the funtionality is there or maybe see if I can get my hands on ISE to confirm.

Joe

[Scott Fella]

I know ISE you can set different lobby sponsor privileges depending on AD Group or internal ISE Groups. ISE though will host the splash page and the wlc only redirects to ISE.

Thanks,

Scott Fella

Sent from my iPhone

[algotsson]

Hi and thanks for your input.

I sent a note to cisco requesting their feedback in this matter. This couldnt be that difficult to implement ...  I'll post their response to this thread.

Thanks

Chris

[thomas.torggler]

Hi there,

any news on this? we would like to set defaults for Lobby Ambassdor accounts (authenticated via RADIUS) too.

Cheers!

tom

[dac_bschlueter]

Hi there,

are there any news on this topic?

We also would like to set defaults for the Lobby Ambassador users who are logged in via RADIUS.

Thanks in advance!

Ben

[stefan.angerer]

Hi,

please have a look at this thread:

https://supportforums.cisco.com/message/3818605

Maybe this is a workaround for you, it definitely depends on the number of lobby ambassadors you have.

regards

Stefan

[patoberli]

Try the solution here: https://supportforums.cisco.com/thread/2115616