I have found the folowing :

Q. What occurs when a guest logs on?

A. When a wireless guest logs in through the web portal, the guest anchor controller handles the authentication by performing these steps:

The guest anchor controller checks its local database for username and password, and if they are present, grants access.

If no user credentials are present locally on the guest anchor controller, the guest anchor controller checks WLAN configuration settings to see if an external RADIUS server(s) has been configured for the guest WLAN. If so, the controller creates a RADIUS access-request packet with the username and password and forwards it to the selected RADIUS server for authentication.

If no specific RADIUS servers have been configured for the WLAN, the controller checks its global RADIUS server configuration settings. Any external RADIUS servers configured with the option to authenticate “network user” will be queried with the guest user's credentials. Otherwise, if no servers have “network user” selected, and the user has not been authenticated through steps 1 or 2, the authentication will fail.

So surely , i'm hitting step 3.

I'm not to comfortable with that type of implementation of Cisco. If i dont define a radius in my ssid, it's with a reason.

Is this documented somewhere in a bug ?

I don't know if Cisco considers this as a bug, but if you have an implementation like what you have, the WLC will always attempt to use the radius server first and then attempt to authenticate users via local DB. Defining a fake radius and using that on the guest wlan is the "workaround". I have asked the BU to change that if possible, but don't know if that will happen anytime soon.

Changing pap to chap has solved my issue !

But heres another one, this feature cannot be configured from WCS.

Is Cisco slipping up ?