topic Re: Captive Portal page to load when user-id is known? in General Topics

Captive Portal page to load when user-id is known?

keklund — Tue, 27 Mar 2012 12:37:17 GMT

Working on an idea to allow a manner of login/logout for users coming through captive portal auth.

On a system that may or may not be identified on the back-end, I can load the captive portal page URL manually and set/change the user-id.

When I try to load the page again, I only get a blank page - is there a URL I can load to generate a 'logout' or ID clear event, or at least some way to force the captive portal to load again so users can enter a dummy 'logout' user?

Re: Captive Portal page to load when user-id is known?

jseals — Wed, 28 Mar 2012 05:07:27 GMT

Hello,

By design Captive-Portal will only redirect to the login page if the user is considered "unknown" by the firewall. The only way I can think of to force the user to login again manually is by running:

> clear user-cache ip x.x.x.x

Of course this isn't ideal, because you'll have to manually clear the user-ip-mapping for each user manually from the cli.

The only other thing I can think of that may help is if you lowered the expiration timer for the Captive-Portal mappings.

Thanks,

Jason Seals

Re: Captive Portal page to load when user-id is known?

keklund — Wed, 28 Mar 2012 12:49:16 GMT

Thanks for the info. We are looking into generating a user-id event against AD as workaround for this. This is for iPads primarily we are thinking a custom app that generates an LDAP login - "logout" would be changing the user-id to a user with no rights.

Re: Captive Portal page to load when user-id is known?

rmonvon — Wed, 28 Mar 2012 19:41:06 GMT

Hi...You may want to review this method: https://live.paloaltonetworks.com/docs/DOC-1642.

Also, if your iPad users are logging into Exchange to get email, our 4.1 UserID agent will monitor Exchange events now. Thanks.