arubanetworks captive portal

2021-12-02 · 3 min read

Source: https://www.arubanetworks.com/vrd/GuestAccessAppNote/wwhelp/wwhimpl/js/html/wwhelp.htm#href=Chap3.html#1035623

Captive Portal #

Captive portal authentication is a Layer 3 authentication method that redirects users to a captive portal page when they start a web session. The captive portal page can be used for various purposes, such as authenticating the guest using a user name and password, providing an acceptable use policy, or self registration with an email address.

Authentication Process #

Captive portal is a Layer 3 authentication, which requires that the devices connect to the network and obtain an IP address and related DNS information before authenticating through the captive portal. The following steps explain the entire captive portal process when the native ArubaOS is used for captive portal authentication:

  1. The device that is associating to the guest SSID is assigned an initial role (guest-logon role in the example configuration). This initial role allows DHCP, so the user gets an IP address.
  2. The user opens a browser and makes an HTTP (or HTTPS) request to some destination (for example, www.bbc.com).
  3. The resolver in the device sends a DNS request to resolve the www.bbc.com. The initial role (guest-logon role) permits DNS services, so the resolver can communicate with the DNS server.
  4. The DNS server replies with the correct address to www.bbc.com.
  5. The resolver tells the browser which IP address to use based on the DNS reply.
  6. The browser initiates a TCP connection to port 80 of the www.bbc.com address.
  7. The controller intercepts the connection and spoofs the initial TCP handshakes of the HTTP process. At this moment, the client browser thinks it is communicating with the bbc.com server.
  8. When the browser sends the HTTP GET request for the web page, the controller replies saying that bbc.com has “temporarily moved” to https://securelogin.arubanetworks.com/[string that identifies client].
  9. The browser closes the connection.
  10. The browser attempts to connect with https://securelogin.arubanetworks.com/[string that identifies client], but it first needs to send a DNS request for the address.
  11. The actual DNS server responds that it cannot resolve https://securelogin.arubanetworks.com, but the controller intercepts that reply and changes the packet to say that securelogin.arubanetworks.com is at the IP address of the controller itself. Remember that it is critical that the DNS server sends back a reply to the query.  It is only then that the controller can spoof the reply back from the DNS server.  Sending a DNS request without receiving a reply is not sufficient, since without a reply the controller will never help the client resolve securelogin.arubanetworks.com.
  12. The browser initiates an HTTPS connection to address of controller, which responds with the captive portal login page, where the guest authenticates.
  13. After successful authentication, the user is assigned the post authentication role (auth-guest role in the example configuration). This is the default role in the captive portal profile.
  14. After authentication, the browser is redirected to bbc.com at the address originally resolved by the DNS. Alternatively, if a welcome page is configured, the browser is redirected to the welcome page.
  15. To successfully redirect to the original web page the controller spoofs a reply from bbc.com to tell the client that bbc.com has “permanently moved” to bbc.com. This step corrects the “temporary relocation” that occurred as part of the captive portal login.
  16. This causes the client to re-query DNS for the address of www.bbc.com.
  17. The browser starts to communicate with the actual bbc.com server.