cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

219
Views
0
Helpful
2
Replies
davy.timmermans
Enthusiast

self registering guest flow - re-authentication?

In all examples of device self registration - authentication seems to be done only after the coa after registration?

auth:

mab : user not found - continue

authz:

if guestendpoint and ssid 'guest' => accept

if  ssid 'guest' : accept + cwa

Thus once a guest device is registered - it's not required to authenticicate anymore? Unless the endpoint is deleted?

1 ACCEPTED SOLUTION

Accepted Solutions
jan.nielsen
Rising star

Not exactly, it's correct that the guest will only use a browser to sign in the first time, but if they get disconnected, they will instead be authenticated by their mac address. The guest device's mac address will be placed in the endpoint group you told it to in the guest config. This group contains the mac address of authorized guests, and should be purged at some set interval, to remove those devices access to the guest network.

View solution in original post

2 REPLIES 2
jan.nielsen
Rising star

Not exactly, it's correct that the guest will only use a browser to sign in the first time, but if they get disconnected, they will instead be authenticated by their mac address. The guest device's mac address will be placed in the endpoint group you told it to in the guest config. This group contains the mac address of authorized guests, and should be purged at some set interval, to remove those devices access to the guest network.

View solution in original post

Hi Jan,

Sorry for the delay.

Thanks for confirming  - makes sense.

Is there a direct relation between user  -  device? Eg. If a user is deleted - are all his registered devices deleted? 

Restricted access  (eg. certain hours) is not possible with this kind of flow I suppose. --> authz needed to be based on guest type?

Thx

Create Content to create content
Content for Community-Ad