Sign-on Splash
External splash pages are stored and executed on a web server that you define, and must respond appropriately to certain messages from the Access Point in order to present appropriate user-interface to the user at various stages of the authentication process.
When combining with RADIUS Authentication, EnGeniusCloud can consult an external RADIUS server that you specify in order to determine whether to authenticate the user. The user interface presented to the user will be determined by the external splash page.
EnGeniusCloud supports three types of RADIUS-based authentication: EnGenius Authentication, Custom Radius, and Voucher Service. All the three types can works with external splash page to perform a sign-on splash service.
Overview
Communication Flow
A new wireless client tries to connect to a Captive Portal enabled SSID served by an Access Point.
The AP intercepts the request and redirect the user to the external splash page which is served by a external web server configured in
SSID's splash page
setting. In addition, anactionurl
parameter is passed to the splash page such that browser can be redirected back to the cloud after submission in splash page.Splash page content with
actionurl
parameter are delivered to browser.User clicks on the login button in the splash page and then be redirected to
actionurl
. The actionurl actually makes Access Point play as a RADIUS proxy to help on authenticating user with Remote RADIUS Server.
Parameters
In previous Section Step 2, the actionurl parameter is composed of a cloud URL with extra parameters. A https request sample to the splash page could be like this:
The https://yourwebsite.com/splash.html here is the splash page setting customized for corresponding SSID. The details of the actionurl parameters are listed as follows:
Parameter Name | Description |
---|---|
vendor | Should be "EnGenius" |
ap_ip | IP address of associated AP |
ap_mac | MAC address of associated AP |
ap_port | AP service port |
client_ip | IP address of the wireless client |
client_mac | MAC address of the wireless client |
userurl | The URL that user tried to visit before authenticated |
mac | Client's MAC address (will be obsolete after 2021) please use client_mac |
called | AP's MAC address (will be obsolete after 2021) please use ap_mac |
nas_id | Network access server identifier is used to notify the source of a RADIUS access request. |
ssidProfileId | Global unique identity of assoicated SSID |
networkId | Global unique identity of the network which the assoicated AP belongs to |
Configure Authentication Type of Captive Portal
Select a network in Org-tree.
Select SSID in the configuring tool menu.
Choose the SSID you want to configure.
Under
Association
Tab, choose "Open", "WPA2 PSK".Switch to
Captive Portal
Tab and choose one of three authentication types: EnGenius Authentication, Custom Radius, and Voucher Service to enable the RADIUS-based authentication.Enable walled garden (located under Captive Portal > Advanced Settings > Walled garden) and enter the public IP address of your web server. The address specified needs to be the public-facing IP address of the web server hosting the Splash page, not the local LAN IP.
Click on
Apply
button.
Enabling an External Splash Page on EnGeniusCloud
Select a network in Org-tree.
Select SSID in the configuring tool menu.
Choose the SSID you want to configure.
switch to
Captive Portal
Tab and make sure your Captive Portal is enabled and Authentication Type is set toClick-through
.switch to
Splash Page
Tab. SelectExternal Splash Page URL
.Enter the URL of your custom splash page (eg, https://yourwebsite.com/splash.html).
Click on "
Apply
" button.
Configure the External Splash Page Server
The external splash page must be hosted on a web server that will be accessible from the Access Points on your network. The following must be accomplished, but the particular details will depend very much on your web hosting environment.
Setup the Web Server.
Modify the splash page to set
form action
as the value ofactionurl
passed by cloud. In this way, after user submits the form, he will be redirected to specific URL and complete the authentication. In order to collect logon credentials, you will need to create an HTML based form that collects and then submits these to the login URL. In its simplest form this could look similar to the code below:
Note that the input field name "username" and "password" are unchangeable. These two input fields are necessary to provide the credential for RADIUS authentication.
Last updated