A guest SSID uses an external captive portal on ClearPass. After successful login on the portal, the client remains in the "guest-logon" role and is not redirected to the original URL. The ClearPass enforcement profile returns the correct "Aruba-User-Role=Guest" and a "Aruba-URL-Redirect" VSA. Which controller configuration element is most likely missing or misconfigured?