Captive Portal page to load when user-id is known?

[keklund]

Working on an idea to allow a manner of login/logout for users coming through captive portal auth.

On a system that may or may not be identified on the back-end, I can load the captive portal page URL manually and set/change the user-id.

When I try to load the page again, I only get a blank page - is there a URL I can load to generate a 'logout' or ID clear event, or at least some way to force the captive portal to load again so users can enter a dummy 'logout' user?

[jseals]

Hello,

By design Captive-Portal will only redirect to the login page if the user is considered "unknown" by the firewall. The only way I can think of to force the user to login again manually is by running:

> clear user-cache ip x.x.x.x

Of course this isn't ideal, because you'll have to manually clear the user-ip-mapping for each user manually from the cli.

The only other thing I can think of that may help is if you lowered the expiration timer for the Captive-Portal mappings.

Thanks,

Jason Seals

[keklund]

Thanks for the info.  We are looking into generating a user-id event against AD as workaround for this.  This is for iPads primarily we are thinking a custom app that generates an LDAP login - "logout" would be changing the user-id to a user with no rights.

[rmonvon]

Hi...You may want to review this method:  https://live.paloaltonetworks.com/docs/DOC-1642.

Also, if your iPad users are logging into Exchange to get email, our 4.1 UserID agent will monitor Exchange events now.  Thanks.