The Sponsor Portal allows authorized sponsor users to create and manage guest accounts within Cisco ISE. By configuring RSA Cloud Access Service (CAS) as the authentication provider, sponsor users can authenticate through RSA before accessing the Sponsor Portal.

Procedure

1. Navigate to Work Centers > Guest Access > Portals & Components.
   
2. In the left pane, click Sponsor Portals.
3. Under Portal Behavior and Flow Settings, expand Portal Settings. 
4. In the Identity source sequence drop-down list, select the RSA External Identity Source that was created earlier.
   Note: A new Identity Source Entity should be created separately, specifically for the Sponsor Portal. 
   
5. Configure CAS to send a group attribute in the SAML assertion. Then, configure Cisco ISE to map the group attribute for user authorization and to assign the required Sponsor Portal permissions.
   • Attribute name: Name of the attribute that will contain the group name.
   • Property: Field containing the value of the group.
     Note: The fields shown in this example are for demonstration purposes only. Select the appropriate fields based on your Active Directory configuration.
     
6. Navigate to Administration > Identity Management > External Identity Sources and open the newly created Identity Source Entity for the Sponsor Portal. Edit the entity, click the Groups tab, and then create a new group attribute.
   • Group Membership Attribute: Name of the attribute in the RSA SAML Assertion that will contain the group name. This should match the attribute name configured in RSA.
   • Name in Assertion: The value of the group attribute sent in the Assertion. 
   • Name in ISE: Mapping of the group sent in the Assertion to a local group in ISE.