show aaa profile <profilename> (from CLI)
Initial role is what is assigned immediately upon connection.
Default role is what is assigned upon authentication, if a different role is not otherwise derived.
For captive portal, use the "initial role" parameter in the AAA profile.