Authentication for Captive & Self-Service Portal

Authentication flow overview #

The SAML authentication flow for Captive-/Self Service consists of the following steps:

The user initiates a Service Provider (SP) Initiated flow which redirects the user to the Identity Provider Single Sign-On URL.
The idP parses the SAML request and authenticates the user. Once the user is authenticated, the idP generates a SAML response.
The idP returns the encoded SAML response to the browser.
The browser sends the SAML response to Netgraph Connect for verification.
If the verification is successful, Netgraph Connect will perform user authorization depending on the matching Sign In – Access Policy.
- If the user is authenticating for internet access via the Captive Portal, the SAML Provisioning Role must be enabled in the matching Access Policy.
- If the user is authenticating for the Self Service Portal, Self Service Access must be enabled in the matching Access Policy.

Configuration #

The following configuration steps need to be performed in order to enable SAML authentication for Captive-/Self Service Portals.

Configure a new idP with the Self Service target
Configure Walled Garden for Captive Portal
Create/update an Access Policy and enable SAML Provisioning Role
Configure the SAML Provisioning Access Settings
Enable SAML as an Active Login Option
Done

1. Configure a new idP with the Self Service target. #

In the side menu, Organization / SAML SSO click Add SSO Identity Provider
Enter a Descriptive name for the provider, e.g. ‘Guest WiFi Azure’ and click Add Identity Provider
Select ‘Self Service’ as Authentication Target
By checking the Display Login Button and entering the button text, users will be able to sign in to the Self Service Portal via SSO. Remember to enable Self Service Access in the corresponding Access Policy.

Please note the Service Provider Recipient URL (above), it’s a unique identifier that is needed when configuring your idP in the next step.
Configure the Identity Provider Details for your Service Provider. Below are a few examples of how to set up your Identity Provider for:
- SAML 2.0 Azure AD configuration example
- SAML 2.0 Google configuration example
- SAML 2.0 Okta configuration example
In the Identity Provider Single Sign-On URL field, enter the appropriate value from your idP (step 6).
In the Identity Provider Issuer field, enter the appropriate value from your idP (step 6).
In X.509 Certificate field, enter the appropriate value from your idP (step 6).
Click Update Identity Provider
Done

2. Configure Walled Garden for Captive Portal #

Since the authentication is performed “externally” by the idP, certain domains need to be accessible to the client prior to authentication.

The walled garden functionality allows you to allow access for clients to a specific set of hostnames prior to authentication.

Depending on your idP, different domains need to be added to the walled garden. Please refer to your specific idP for the latest information but below are the recommended domains for the most common idPs:

Microsoft Azure:

login.microsoftonline.com
myapps.microsoft.com
account.live.com
aadcdn.msauth.net
aadcdn.msftauth.net
account.activedirectory.windowsazure.com

Google:

accounts.google.com
accounts.google.se (where .se is country-specific and depends on your organization, multiple entries may have to be added)
fonts.gstatic.com
ssl.gstatic.com
lh3.googleusercontent.com
accounts.youtube.com

Okta:

login.okta.com
ok12static.oktacdn.com
your-organization-domain.okta.com (where your-organization-domain is specific for your organization)

Auth0:

auth0.auth0.com
cdn.auth0.com

Now that you know which hostnames need to be added to your walled garden, it’s time to configure it. Depending on your service setup this is done in two different ways.

If you are using Meraki, then you need to configure Meraki Walled Garden.
If you are using a Service Gateway, then you need to Configure Service gateway Walled Garden as described in Sign In – Common Settings.

And of course, if you are using a mixed setup with both Service Gateway and Meraki, you need to do both.

Note: Please note that there may be a few minutes delay before the walled garden settings take affect.

3. Create/update an Access Policy and enable SAML Provisioning Role #

Navigate to Sign In Administration / Access Policies

Create or update the Access Policy that will enable users to authenticate via SAML.

4. Configure the SAML Provisioning Access Settings #

Configure the SAML Provisioning Access Settings

5. Enable SAML as an Active Authentication Method #

Enable SAML as an Active Sign In method on the Captive Portal

6. (Optional) Disable Multi-factor authentication (MFA) for Captive Portal logins #

MFA is great and highly recommended for securing sensitive resources. There are, however, some cases where MFA may cause challenges to the end user. One such case can be dealing with MFA while signing in via the Wi-Fi Captive Portal login dialog. The reason is the state of the Captive Portal itself where many devices don’t allow any multitasking while in the “captive state”. This makes it impossible to open other applications, such as Microsoft Authenticator or 1Password while logging in via the captive portal.

One solution is to prevent MFA to occur for Captive Portal Logins. This is configured with your Identity Provider and an example of how it can be done in Microsoft Azure AD using Conditional Access Policies is described in this article.