Third-Party Hosted Captive Portal with RADIUS Authentication

These steps describe the work flow for guest user authentication to a portal using RADIUS:

1. A Wi-Fi user connects to the guest SSID and opens a URL from any web browser using the HTTP protocol.
2. The AP intercepts this request and redirects the browser to the configured external portal page, including these request parameters as the GET parameters of the redirected URL. For example:

https://www.example.com/guest-login.php?res=notyet&challenge= b22bc0c9da62277a4138b5d0d686bf2c&service_id=&login_url=http://172.17.30.54:5282/logon&logoff_url=http://172.17.30.54:5282/logoff&ap_id=00:11:74:96:57:BF&uamip=172.17.30.54&uamport=5282&ap_ssid=Guest-Wi-Fi&client_mac=8C:FA:BA:89:07:8C&blackout_time=0&userurl=http://www.watchguard.com/&failure_count=0

• Challenge (challenge) — A random sequence of bytes in the hexadecimal format provided to the portal for encoding the plain text password.
• Login URL (login_url) — Portal redirects the web browser to this URL after accepting the username and password from the user.
• AP MAC address (ap_id) — MAC address of the AP.
• AP IP address (uamip) — IP address of the AP.
• AP Port Number (uamport) — Port number on which the HTTP service is available on the AP.
• Failure Count (failure_count) — Number of previous failed attempts by the client.
• Requested URL (userurl) — Original URL requested by the browser that was intercepted by the AP.
• Logoff URL (logoff_url) — URL to which the client needs to be redirected for the purpose of logging off from the AP.
• Blackout Time (blackout_time) — Remaining blackout time.
• Request Type (res) — Type of request to the portal. This is provided if the portal supports more than one kind of work flow.
• Client MAC (client_mac) — MAC address of the Wi-Fi client.

3. The client web browser is redirected to the external splash page for the portal and the user is prompted to type their user name and password.
4. The captive portal on the external web server encodes the password with a key generated with the shared secret for the portal that is configured in the SSID Profile and the challenge generated and sent by the AP in the redirected URL in Step 2.
5. The web server uses the login_url parameter from step 2 and appends these GET parameters to the UR L. The portal then redirects the client web browser to this new generated URL (new login URL). For example: http://172.17.30.54:5282/logon?res=success&username=guest&password=a2b89067c1d0781d

• User name (username) — User name provided by the user in plain text.
• Password (password) — An encoded form of the password provided by the user.
• Response Type (res) — Set to "success" or "failure" based on the authentication credentials provided by the user.
• Login Time (session_timeout) — Optionally, the portal can append the time in seconds for which the Wi-Fi client can access the guest network. After this timeout, the client is redirected to the portal again. If not appended, the client session times-out after the default login timeout configured in the SSID Profile.
• Redirect URL (redirect) — Optionally, the portal can append the URL to which the web browser is redirected after successful authentication. If not appended, the client is redirected to the redirect URL configured in the SSID Profile or the original requested URL.

6. The client requests access to the new login URL (redirected from the portal) to the AP.
7. The AP decodes the password using the shared secret for the portal configured in the SSID profile and the challenge that it originally sent in step 2.
8. The AP sends the user credentials (user name in plain text) from Step 5 and a re-encoded password using the RADIUS shared secret to the RADIUS server for authentication.
9. The RADIUS server decodes the password and authenticates the user. if successfully authenticated , the AP allows the client to access the Internet.
10. The AP redirects the client web browser to the URL sent by the portal (redirect parameter). If the portal did not include the redirect parameter in the login URL in step 5, then the client browser is redirected to the URL configured in the Redirect URL field in the Captive Portal settings of the SSID Profile. If the redirect URL is not configured in the SSID Profile, the client web browser is redirected to the original URL accessed from the client in step 1.

How the Encoded Password is Generated

After the user enters the username and password on the captive portal splash page and submits it for login, the captive portal must perform these tasks:

1. Encode the password.
2. Regenerate a login URL using the login_url parameter it received in the request and append the username and encoded password to the URL.
3. Redirect the client to this new login URL.

These steps describe how the password is encoded:

1. Convert the challenge parameter sent by the AP from hexadecimal to a byte value.
2. Generate the key using an MD5SUM of the portal shared secret. If the key length is smaller than the password length, repeat the process until the key is long enough to hide the password.
3. Encode the plain text password by XOR with the key and convert it to hexadecimal string.

This example code snippet shows how to encode the password using PHP:

<?php 

class RADIUSPortal{ 

	/* These must be initialized from the get parameters provided by AP while redirecting to the portal URL. */

	public $logonURL = ''; 

	public $challenge = ''; 

	/* The configured shared secret value must be assigned here (same as 

	that in the SSID profile portal settings). */ 

	public $sharedSecret = null; 

	/* username and password submitted by the user in the login form */ 

	public $username; 

	public $password; 

	/* Get logon Url. Redirect to this URL from caller. 

	@return string */ 

	public function getApLogonUrl() { 

	$encodedPassword = $this->encodePassword($this->sharedSecret); 

	$responseParam = "res=success&challenge=" . $this->challenge . "&password=" . 

	$encodedPassword[1] . "&username=" . $this->username; 

	return sprintf('%s?%s', $this->logonURL, $responseParam);

 	} 

	/* Encode the password using challenge and shared secret 

	* @param type $sharedSecret 

	* @return string */ 

	protected function encodePassword($sharedSecret) { 

	/* Convert the challenge from HEX (40bytes) to binary(20bytes) */ 

	$asciiChallenge = pack("H*", $this->challenge); 

	$key = md5($asciiChallenge . $sharedSecret, true); 

	# If key isn't long enough, repeat it until it is 

	while (strlen($key) < strlen($this->password)) { 

	$key .= $key; 

	} 

	$encodedPassword = unpack("H*", substr($this->password ^ $key, 0, 

	strlen($this->password))); 

	return $encodedPassword

	}

}	 

?>