topic Re: Captive Portal - users not supplying domain info in General Topics

Captive Portal - users not supplying domain info

Jeff_K — Thu, 16 May 2013 19:24:28 GMT

Our captive portal is configured to use RADIUS (Cisco Secure ACS) to authenticate our AD users. The Cisco ACS will authenticate a user even if they do not include their domain information in the userid string... 'userid' rather than 'domain\userid'. The problem with this is that a user who authenticates with only their userid ends up with a ip-user-mapping that will not match a userid that is pulled in with the User Identification Group Mapping Settings.

Our Cisco ACS box does not appear to be able to filter the undesirable ones out.

Has anyone dealt with this already? Maybe there is a way to sanitize the input on the Captive portal comfort/login page?

Thanks, Jeff K

Re: Captive Portal - users not supplying domain info

mbutt — Thu, 16 May 2013 21:38:24 GMT

Hi Jeff,

Try adding the domain name in the Radius Profile

Example:

Also another good reference for similar issue can be seen here

https://live.paloaltonetworks.com/message/27165#27165

Hopefully this helps.

Thank you

Re: Captive Portal - users not supplying domain info

Jeff_K — Fri, 17 May 2013 01:35:58 GMT

This is useful information. I can see this working for a single domain but we have multi domains.

I suppose I could put a bogus domain name in the RADIUS profile, then at least the authentication attempts will fail and a bad ip-user-mapping will not be created.

I subsequently tried this but got undesirable results. An authentication request with domain information is passed untouched to the RADIUS server but the resulting ip-user-mapping is created with whatever domain is set in the RADIUS profile.

Thanks! Jeff K

Re: Captive Portal - users not supplying domain info

Jeff_K — Fri, 17 May 2013 11:42:20 GMT

In regard to the Captive portal comfort page, it would be great if the user input form script called by <pan_form/> could be modified to include a field to enter the domain ... this would avoid a lot of confusion. Anyone know if this is possible?

Thanks, Jeff K