ISE Multiple SSIDs using CWA

Question

I am using ISE 1.2.198 primarily to authenticate guest users.
I have 2 types of guest - day visitors and longer term visitors.
I am using 2 separate SSIDs on a 5760 controller.
On the ISE I have authentication conditions to differentiate between the different SSIDs and apply the relevant policy set.
I am using CWA with wireless MAB for both policy sets.
Everything is working fine using different portals for each SSID.
I have Sponsors set up to create accounts, to assign different roles (guest or partner) and to apply different time profiles. That all works and the account details get emailed to the recipient successfully.
The issue I have is that the sponsored account credentials can be used to authenticate a user on either SSID.
If the sponsor creates an account and assigns it to the guest role that user can authenticate successfully to both the guest and partner SSIDs with the same credentials. Similarly, if the account is assigned to the partner role, the user can again authenticate to both SSIDs.
There must be a way to differentiate between different roles within the authorization policies.
I can't find a way within the Policy Sets to separate the 2 types of users. Adding any conditions to the authorization rules that include the Network Access UseCase equals Guest Flow doesn't seem to have any affect.
Has anyone managed to do this type of thing successfully?

Answer 1

Roger,
If you are using Active Directory as your Identity Source, then that is your issue.  As you know, ISE 1.2 is limited in AD Authentications.  What I would suggest is to go to Administration > Identity Management > External Identity Sources and set up an LDAP connection to the AD group from which you would like to authenticate.  One for each type of guest and choose only the AD Group that Guest type uses:
Once this is done, create an new Identity Source Sequence for each Guest type:
Then go to Administration > Web Portal Management > Settings and choose the Guest Portal you want to modify.  Click The Authentication tab and choose the Identity Store Sequence you just created for that portal.
That should fix the issue.
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question.  Otherwise, feel free to post follow-up questions.
Charles Moreton