WLC9800 Lobby Admin - Password has expired

[mel.novilla]

I have an issue regarding on the Lobby Ambassador Admin of WLC9800 where the credential is configured from Cisco ISE TACACS+ 

Initially, it can log on successfully using the username and password configured from Cisco ISE TACACS+, however, it immediately prompt that "Password has Expired" 

Confirmed that TACACS+ credential has been set to "never expires" 

WLC version 17.12.4 / Cisco ISE Version 3.4 Patch 1

[Scott Fella]

A few things, towards the bottom on the user id in ISE, you don't have "Disable account if date exceeds" enabled? You have tried on multiple browsers just in case something got cached? If you create a new account or if you just update the password again, you still have the same issue?

[mel.novilla]

"Disable account if date exceeds" is unchecked

I have tried different browsers (edge, firefox and chrome) but still the same

I have also delete the old credential and add a different one with new password but same issue.

Configured a Full Admin credential and tested working fine without this pop-up window "Your password has expired"

Any other workaround for this Lobby Admin account?

[mel.novilla]

[Scott Fella]

Well.. you ISE looks good.  There is a policy setting also in ISE, but maybe that is related to just admin. Nothing in your TACACS policy or live logs you see out of the ordinary or even compare the failed with the new admin account you created.

[mel.novilla]

No logs on every success of failed login

[Scott Fella · Accepted solution]

You need to uncheck this check box? Do you recall how long it was working for before it stopped?  You can run some debugs on the controller also to see what gets logged when you try to login to the portal with that username.

[mel.novilla]

Thanks @Scott Fella, it is working as expected now.

[Haydn Andrews]

What does the TACACS live logs for the authentication show? Also change password on next login not ticked is it?

[mel.novilla]

Says nothing but i can login using the configured Full Admin credentials

[Scott Fella]

Well I decided to try to lab this out.  This is what I found, so make sure you look over the policies for internal users.

[mel.novilla]

Same Cisco crap thing