This article outlines how Purple’s WiFi login process functions, covering the typical transactions a client might take in logging onto WiFi.
After setting up your WiFi Controller with Purple, users connect to the SSID your Controller is broadcasting for the public WiFi service. They will typically be redirected to Splash Pages for login into the Captive Portal.
Once they have provided registration details, they are passed to our RADIUS (authentication) server for login and granted a session by RADIUS. The person’s device is then allowed online by the Controller, based on the session granted by RADIUS.
The following diagram details that process:
For reference, the terms used are:
Client: the person connecting to the WiFi
Device: the device they use to connect to the WiFi - e.g. a phone, tablet or laptop PC
Venue: the location where Purple’s WiFi login service is deployed
Controller: the systems used to deploy the WiFi
The step-by-step WiFi authentication process entails:
The end user connecting to the SSID
1) The end user connects to the SSID on their device.
2) If MAC authentication is enabled, the AP will perform RADIUS authentication against our RADIUS. If authentication was successful, the AP will send accounting details to our RADIUS.
With MAC authentication, the authentication is completed outside the usual Captive Portal login process. If the client has connected at the Venue previously (so we know who they are) RADIUS will authenticate them before the Captive Portal shows, which streamlines their login process.
Check and redirection
3) If MAC authentication is disabled or was unsuccessful, the Captive Network Assistant (CNA) window will pop up on the device and redirect the user to the splash page.
When this redirect happens, the AP automatically appends additional parameters to the query string which should be appended to the splash page URL. An example URL is:
https://purpleportal.net/access/?login_url=http://1.1.1.1/login&ap_mac=AA-BB-CC-DD-EE-FF&client_mac=11-22-33-44-55-66&orig_url=bbc.co.uk&ssid=FreeWiFi
You will see the following information in the URL:
login_url − the AP/Controller login URL to which we should send the login request in step 4
ap_mac − the MAC of the AP/Controller
client_mac − the MAC of the end user device
orig_url − the original URL that the end user tried to access
ssid - the SSID the user connected to
We use the “ap_mac” value to determine which venue the end user is connecting to, in order to display the correct splash page. We also use the “client_mac” value to determine whether we’ve seen this device before.
Login method
4) Depending on what the customer has enabled on their splash page, the user will choose which login method (form, social media, etc.) they wish to use.
5) If Paid WiFi is enabled, the end user will be provided with a list of free and/or paid plans. If the user selects a paid plan, they will be redirected to the payment page in order to gain access to the service.
Authentication and getting online
6) The end user needs to be authenticated against our RADIUS in order to remove the captive portal restriction and be provided with full internet access.
Depending on the hardware/vendor type, we perform a request to the “login_url” captured above, together with a randomly generated username and password for this session. This username/password has also been created on our RADIUS database in order for the RADIUS authentication to succeed.
7) The AP/Controller performs RADIUS authentication by sending an “Access-Request” to our RADIUS.
8) Upon a successful RADIUS response (Access-Accept), the AP authorizes the device, removes the captive portal restrictions, and the end user will be online.
9) The AP/Controller sends an accounting “Start” packet to our RADIUS in order to confirm the device is now authenticated and fully online. With the client being provided an authenticated session, the RADIUS Accounting transactions with the Controller are also acknowledged.
10) The device is redirected to the configured online splash page or a custom URL.