ISE and self register

Hello,
Can ISE differentiate and see on which wireless AP a user(MAC) connects ?
Goal: i want to allow guest self registration, but not from any Access Point. We have a presentation room where presentation for third parties are given regularly. This room is covered with two high-density capable APs. I only want to allow guest in this room to generate their own guest accounts for 1 day from these APs, not every user on every Access Point.
(and i want to avoid creating a dedicated different SSID for this)
regards,
Geert

This document describes how to configure authorization policies in Cisco Identity Services Engine (ISE) to distinguish between different service set identifiers (SSIDs). It is very common for an organization to have multiple SSIDs in their wireless network for various purposes. One of the most common purposes is to have a corporate SSID for employees and a guest SSID for visitors to the organization. Please check below link for certificates configurations.
http://www.cisco.com/image/gif/paws/115734/ise-policies-ssid-00.pdf

Similar Messages

ISE and Self Registration

Ciao,
is it possible to send user and password credentials, created by self registration, via mail or SMS ?
For example:
- user connect open ssid,
- open browser and ISE, after redirect, present http guest portal with self-registration,
- user compile form of self registration with email or phone fields,
- credentials are send via email (not displayed as default).
Thanks,
Regards,

Self-registered users : Auto activate and add ESS role ?

Hi all ,
we are allowing users to self-register for our ESS portal. We would like to auto-activate the users and give them the ESS role without any Admin action .
Is this possible ?
Regards
Daniel

Hello Daniel,
please assign your ESS Role to the group "everyone".
Then the self registered(but also every other user on the portal) will have this role by default.
Assign Default Role to User
Regards
Frank

ISE and no External Identity Source

I have this particular case in which I need to make authentications for users in ISE without Active Directory/LDAP etc.
I would like to have some kind of MAC to USER binding where the user would no be able to add more devices to the network. I know the eap chaining using anyconnect is a way of achieving this but then again I can only see it using AD or some kind of external database. Also printers, wireless and phones are in the map. I tried using MAB and CWA for this but do not want to have the users be able to self register their devices as if they were guests.
EAP chaining without AD??? Possible?
Any hope?
Thank you

Someone else can chime in here but I don't think it is possible to perform EAP-Chaining with the internal database of ISE. With that being said, feel free to read the EAP-TEAP IETF doc :)
http://tools.ietf.org/html/draft-ietf-emu-eap-tunnel-method-01

ISE Guest Self-Provisioning Portal

Hi,
I get the Guest portal page and my credentails authenticate correctly and the device is authenticated using MAB. Then I redirect to Self-Provisioning portal and get this message
This device has not been registered
You need to manually configure your device
Your device configuration is not supported by the setup wizard
Device ID < MAC of my windows XP PC
Any idea how to enable self registration for gests?
My goal is when guest is authenticated in first time it need to enter credentials and to registered MAC address,then when guest come again it need to pass only authentication, without registration MAC address.
Thanks

Tarik, where is the mistake in my steps?
1) I create Authorization Profile for Guest devices registration (see attach AuthProfile)
2) I create Authorization Profile for Web Registration
3) I create Authorization Policy (see attach AuthPolicy)
When user connects to the network, he is redirected to Guest Portal where he needs to aply AUP, after clicking "Accept" error appears (see attach ISE_Error). In ISE I see the folowing errors (see attach ISE_Auth_Error).

Error on accessing the OIM Self Register page.

Hi,
I had modified the 'Self Register' Request template on the Admin Console UI to include a new custom attribute.
Since then, I have removed the custom attribute from the User Configuration and uploaded a new SelfCreateUserDataset.xml.
On accessing the self register page, it throws the an error with the following message: -
"Invalid restriction specified for the attribute Role in template Self-Register User. Corresponding Attribute or Attribute Reference not found in the Request Data Set."
Kindly let me know how to restore the template in UI to the factory setting.
Thank you,
Bhaskar

-

ISE and Guest Portal

WLC - 7.2.110.0
ISE - 1.1.1
I'm new to ISE. I want to set up a very basic method for BYOD users to access our wireless network. I've set up an SSID for external Web Auth, where users get redirected to the ISE Guest Portal: https://1.2.3.4:8443/guestportal/Login.action
At that screen, users can enter their Active Directory credentials and login. Although the authentcation shows as successful under Operations -> Authentications, the user is redirected to the device registration page. On that page they see the message "We are unable to determine access privileges in order to access the network. Please contact your administrator." Their device MAC is listed, and they can enter a description but the "Register" button is greyed out.
I'm getting overwhelmed with the amount of documentation available as well as the new terminology. I'm familiar with using Windows RADIUS servers, but ISE is very foreign to me now. Is there any documentation to help me understand how access requests are processed?

As you asked the documents related to ISE and Guest Portal. I am sending you two docs which will help you in this case. Please find the below documents:
http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_guest_pol.html
http://www.cisco.com/en/US/docs/security/ise/1.0.4/user_guide/ise10_guest_pol.pdf

ISE and authenticating against Windows AD with RADIUS realm that is different from the Windows domain

Hello
We are in the process of evaluating the Cisco ISE VMWare appliance with a view to replace our existing FreeRADIUS installation as authentication provider for our wireless network and VPN service. As a part of this we are hoping to migrate our user authentication to Microsoft Active Directory - we have previously authenticated against a different identity store (not MS AD). Because of this legacy our Windows domain is not the same as our RADIUS realm name - the Windows domain is "win.mydomain" whereas we wish to allow users to authenticate using "username@mydomain" or even "[email protected]" as they are doing today. We are experiencing an issue where authentication requests with the format "[email protected]" will be forwarded to the Windows AD whereas authentication requests with the format "username@mydomain" will fail with the log message "User not found in Active Directory". We do not know if the ISE itself is validating the username and triggering this error, or if the error originates from AD. We suspect the that the ISE is not even asking AD because "win.mydomain" is the domain configured in "Active Directory" in "External Identity Sources".
Authentication requests against the AD without a realm are successful (that is, using only "username"). With this in mind we located a post on the Cisco support forums that described a process of proxying the request back to the ISE and strip the realm information, but this was specific for the ACS platform. We have attempted to implement this solution but it is still not working as we would have hoped, and we are not entirely certain where the fault might lie. We are currently using PEAP with MSCHAPv2 for authentication in our WLAN where the main problem is. We suspect that the "proxy-to-self" with realm stripping is an issue with PEAP.
Is there a supported method of achieving our goal, or should we abandon the ISE platform as our scenario is simply not supported?

Seems like your issue maybe related to DNS, when ISE receives the format [email protected], the dns request is failing. However, there is a setting for alternate UPN Suffixes that can be configured to include domain.com and student.domain.com.
Here is a windows article that should fix this for you. Once you get this updated please reboot ISE so it rejoins AD. Try your tests again.
http://technet.microsoft.com/en-us/library/cc772007.aspx
Thanks,
Tarik Admani
*Please rate helpful posts*

ISE does not register nodes - (blank pop-up window)

Hello everyone !
There CiscoISE 1.1.4.218 (all 8 patches) consisting of 6 nodes (2 admin, 2 monitors, 2 policy) on virtual machines.
When testing failover between policy node, one of policy nodes has been removed from scheme of deployment. The result of attempting to register this node is the blank warning pop-up window, progress of registration stops without registration of policy node (screenshot in attachment). The same
thing happens when I try to register a secondary monitoring nodes (that was removed earlier, like in the case with police node). I also attach a portion of log file taken from admin node (CLI) in the moment of attempts registration of police / monitoring nodes.
In the DNS is ok (defined in both side), all certificates are valid.
Maybe somebody has already found a similar mistake ?
Sincerely,
Andrey

Please check the following Prerequisites
The fully qualified domain name (FQDN) of the standalone node that you are going to register, for example, ise1.cisco.com must be DNS-resolvable from the primary Administration ISE node. Otherwise, node registration will fail. You must enter the IP addresses and FQDNs of the ISE nodes that are part of your distributed deployment in the DNS server.
•The primary Administration ISE node and the standalone node that you are about to register as a secondary node should be running the same version of Cisco ISE.
•Node registration fails if you provide the default credentials (username: admin, password: cisco) while registering a secondary node. Before you register a standalone node, you must log into its administrative user interface and change the default password (cisco).
•You can alternatively create an administrator account on the node that is to be registered and use those credentials for registering that node. Every ISE administrator account is assigned one or more administrative roles. To register and configure a secondary node, you must have one of the following roles assigned: Super Admin, System Admin, or RBAC Admin. See Cisco ISE Admin Group Roles and Responsibilities for more information on the various administrative roles and the privileges associated with each of them.
•If you plan to register a secondary Administration ISE node for high availability, we recommend that you register the secondary Administration ISE node with the primary first before you register other Cisco ISE nodes. If Cisco ISE nodes are registered in this sequence, you do not have to restart the secondary ISE nodes after you promote the secondary Administration ISE node as your primary.
•If you plan to register multiple Policy Service ISE nodes running Session services and you require mutual failover among those nodes, you must place the Policy Service ISE nodes in a node group. You must create the node group first before you register the nodes because you need to select the node group to be used on the registration page. See "Creating, Editing, and Deleting Node Groups" section for more information.
•Ensure that the Certificate Trust List (CTL) of the primary node is populated with the appropriate Certificate Authority (CA) certificates that can be used to validate the HTTPS certificate of the standalone node (that you are going to register as the secondary node). See the "Creating Certificate Trust Lists in the Primary Cisco ISE Node" section on page 12-24 for more information.
•After registering your secondary node to the primary node, if you change the HTTPS certificate on the registered secondary node, you must obtain appropriate CA certificates that can be used to validate the secondary node's HTTPS certificate and import it to the CTL of the primary node. See "Creating Certificate Trust Lists in the Primary Cisco ISE Node" section on page 12-24 for more information.

Self-Register user workflow add user to Group

Hi,
I have a fairly basic Self-Register user workflow that I am playing with in OAM. I am wondering if I can somehow add a step(s) into my workflow that will add the user to be a member of a Group in OAM during registration?
If so, can this be done without an "external action" or custom code?
If anyone knows anything that can help I'd appreciate it.
Thanks,
Jackie

Here is a solution but will work only if users click on the appropriate self registration links. Also may not be very feasible in cases where self registered user need to be added to a group from large number of groups.
In the workflow step did you configure multiple targets?
You can configure multiple targets under the workflow domain you have chosen.
To self-register a user under a particular group you need to provide a self registration link to users with ObDomainName query string configured appropriately.
Eg:
Self registration Workflow domain is dc=acme, dc=com
Say you want users to be added to groups
cn=users1,dc=acme,dc=com and
cn=users2,dc=acme,dc=com.
For this create 2 Targets in 2nd step of your workflow for the two groups you want user should be added to. Now you have effectively two self registration urls,
http://host:port/identity/oblix/apps/userservcenter/bin/userservcenter.cgi?program=workflowSelfRegistration&ObWorkflowName=...<your value here>...&ObDomainName=cn=users1,dc=acme,dc=com
http://host:port/identity/oblix/apps/userservcenter/bin/userservcenter.cgi?program=workflowSelfRegistration&ObWorkflowName=...<your value here>...&ObDomainName=cn=users2,dc=acme,dc=com
Now if you can manage users to click on appropriate links then you can achieve the goal.

Allow creation of Self Registered Users

Under Portal Settings in the Admin section is a checkbox to "Allow creation of Self Registered Users". And a note that says "Changes in these settings will take effect immediately."
I'd like to utilize this feature and have therefore checked the box, and made sure my custom login adaptive layout includes this tag: <pt:ptui.createaccount />
After giving the setting a good hour to work its magic, the view source shows that the tag creates just this: <span id="pt-login-create-account"></span>
I was assuming that there'd be some more code than that - at least a link!
Any idea what might be the issue? It seems like such a straight forward type of setting.
Thanks

The issue has been narrowed down slightly by including the problematic extranet login page as a portlet within our intranet - which then succeeds in displaying the page.
One item of note was that we have the admin area installed on both of our load balanced intranet servers - and each had to be set to allow creation of users via the admin interface before it could be seen by all. This is slightly disconcerting as we assumed they relied on the same data repository (db).
Fortunately, this might be a clue as to why it isn't working still on our extranet server.
The catch there is that we can't access the admin interface via our extranet - so I'm now in the process of trying to track down exactly where this value is saved to from the project settings page.
Any suggestions?
Thanks!
Solution--
I set our extranet to be able to display the admin section, restarted the server, logged in, checked that the admin setting was correct, reset the config file, restarted the portal and then the link magically appeared.
Lesson learned - don't trust the documentation when it says that a restart isn't required...

Self registering of Guest user

Hi,
I want to enable the self register option for the guest user.I can't see self-registration link on the Welcome screen.I have done the following steps.
1.Ticked self-registration for guest at UME.
2.Seted ume.logon.selfreg=TRUE in VA.
3.Assign the action "ume.selfregister_user" to the role "Everyone"
4.and finally restarted.
but still I am unable to see the link for "Self Registering".
Am I missing something?
Regards
Indranil

Hi Indranil,
You have missed the following two steps after server restart:
1) Configure the Standard User Role (eu_role):
a. Navigate to Content Administration --> Portal Content
b. Navigate to Portal Content --> Portal Users --> Standars Portal Users -->Standard User Role.
c. Open the Standard User Role
d. select in the "property Catagory" combo box in the property Editor frame the "User Management Permissions" option.
e. Change the following fields:
i. Manage_My_Profile --> yes
ii. Manage_My_Password --> yes
iii. Read_My_Profile -->yes
iv. Selfregister_User --> yes
f. Save the changes in the save button in the left size of the screen.
And then,
2) Assign eu_role to everyone group
- Anagha

Self-Register User Notifications

I need to send out several email notifications during a self-register user request: Request Initiated, Request Awaiting Approval, Request Approved/Rejected. It seems that OIM 11g/SOA is only setup to handle 2 out of these 4. The SOA engine can notify the approver of the pending approval. OIM can notify the end-user that the account was approved and created based on the Self-Register User Event. Unfortunately, there doesn't seem to be an OIM event or enough data passed to SOA to handle the Request Initiated or Request Rejected scenarios. I am wondering if anyone knows of a way to meet these requirements?
Thanks,
Pete

Here is a solution but will work only if users click on the appropriate self registration links. Also may not be very feasible in cases where self registered user need to be added to a group from large number of groups.
In the workflow step did you configure multiple targets?
You can configure multiple targets under the workflow domain you have chosen.
To self-register a user under a particular group you need to provide a self registration link to users with ObDomainName query string configured appropriately.
Eg:
Self registration Workflow domain is dc=acme, dc=com
Say you want users to be added to groups
cn=users1,dc=acme,dc=com and
cn=users2,dc=acme,dc=com.
For this create 2 Targets in 2nd step of your workflow for the two groups you want user should be added to. Now you have effectively two self registration urls,
http://host:port/identity/oblix/apps/userservcenter/bin/userservcenter.cgi?program=workflowSelfRegistration&ObWorkflowName=...<your value here>...&ObDomainName=cn=users1,dc=acme,dc=com
http://host:port/identity/oblix/apps/userservcenter/bin/userservcenter.cgi?program=workflowSelfRegistration&ObWorkflowName=...<your value here>...&ObDomainName=cn=users2,dc=acme,dc=com
Now if you can manage users to click on appropriate links then you can achieve the goal.

Read Self Register Request using 11g API

Gurus,
I am trying to read Self Register Request using API but I am getting beneficiaries and requester data as null.
Can you please provide some code snippet to read beneficiary data from a Self Register Request.

Gurus,
I am trying to read Self Register Request using API but I am getting beneficiaries and requester data as null.
Can you please provide some code snippet to read beneficiary data from a Self Register Request.

Self Register customization

Hi experts, how can new fields be added to Self Register page.

you need to add your user defined field (UDF) in OIM design console first and then you need to modify the Formmetadata.xml file to display that filed on the self registeration page. Check this URl, the steps are same for the lastest version as well.
http://download.oracle.com/docs/cd/B32386_01/generic.902/b32145/custselfreg.htm
Thanks,

ISE and self register

Similar Messages

Maybe you are looking for