Self-Provisioning with SAML Single Sign-On (SSO)

Overview #

The BYOD SAML Authentication Module enables seamless and secure user authentication via a captive portal integrated with a SAML identity provider (IdP). Users can sign in using their existing Microsoft 365/Azure AD, Google Workspace, Okta, or other SAML-based credentials, eliminating the need for separate WiFi passwords. This is an ideal solution for BYOD environments, allowing organizations to streamline user authentication while maintaining security and access control.

1. User Login Process #

1. The user selects the Guest WiFi network.
2. They are redirected to the Captive Portal, where they choose the SAML Authentication option.
3. Before proceeding, the user must accept the Terms and Conditions and acknowledge the Privacy Policy.
4. The user is redirected to their organization’s SAML Identity Provider (IdP) (e.g., Microsoft 365, Google Workspace, Okta) to complete authentication.
5. The authentication process is handled entirely by the IdP, and no user credentials are proxied or stored within the captive portal solution.
6. Upon successful authentication, the SAML response signals to the captive portal that the login was successful.
7. The user is granted network access and redirected to a predefined URL, such as an intranet or corporate portal.

#

2. Configuration & Customization #

Administrators can configure the SAML-based login module through the Admin Portal with the following options:

🔹 Viewing & Managing SAML Logins #

📌 Sign In Administration → Sign In Modules → SAML Logins

• View user login history, including timestamps, authenticated users, and active devices.
• Revoke or manage active sessions based on policy settings.

🔹 Configuring Captive Portal Text & UI for SAML Authentication #

📌 Sign In Administration → Login Portal → Portal Configurations → SAML Access Settings

• Customize the login page text, including instructions and branding.
• Modify redirect URLs post-authentication.

🔹 Configuring Terms and Conditions & Privacy Policy Acceptance #

📌 Organization → Compliance → Terms and Conditions & Privacy Policy

• Define and update Terms and Conditions and Privacy Policy that users must accept before authentication.
• Ensure compliance with regulatory and corporate policies by enforcing acceptance before granting access.

🔹 Setting Up SAML Integration with an Identity Provider (IdP) #

📌 Organization → Accounts → Federation Configuration

• Connect the captive portal to an external SAML IdP (e.g., Microsoft 365, Google Workspace, Okta).
• Configure authentication endpoints, certificates, and metadata exchange.
• Define domain-based access policies and role-based authentication rules.

🔹 Configuring Access Policies #

📌 Sign In Administration → Access Policies

• Define session duration, device quotas, and redirect settings based on the authenticated user’s domain.
• Example: If a user logs in with john.doe@domain.com, the system matches @domain.com against an Access Policy to determine:
  • Allowed session duration
  • Device quota limits
  • Redirect URL after authentication

3. Security & Compliance Considerations #

• Centralized Authentication – All authentication requests are processed via the organization’s Identity Provider (IdP), ensuring consistency and security.
• No Credentials Stored or Proxied – Authentication occurs directly with Microsoft, Google, Okta, or another IdP, ensuring that no usernames or passwords pass through or are stored in the captive portal solution.
• User Consent Requirement – Users must explicitly accept the Terms and Conditions and acknowledge the Privacy Policy before authentication can proceed.
• Reduced Attack Surface – Eliminates the need for local WiFi passwords, reducing the risk of compromised credentials.
• Automated Session Control – If a user reaches their device quota, the system automatically disconnects the device that was last seen online and allows the new device to connect immediately.
• Logging & Auditing – Detailed logs of logins, session durations, and device activity are available for compliance tracking.

Benefits of BYOD SAML Authentication #

✔ Single Sign-On (SSO) Convenience – Users authenticate with existing credentials, reducing password fatigue.
✔ Improved Security – Authentication is handled through a trusted Identity Provider (IdP).
✔ Seamless User Experience – Instant access to WiFi without additional setup steps.
✔ Scalability Across Multiple Locations – Works consistently across offices, campuses, and remote environments.
✔ Self-Service Flexibility – Users can manage their own connected devices via the Self-Service Portal.