Deployment Guide

Verifying a Signed Request Basic Validation Checks
The following items can be considered when validating the redirect prior to computing the signature:
1. Does the request contain a token parameter, a WLAN parameter, and a destination URL? If not, the
request either did not come from the controller or was tampered with en route.
2. If the request contains a timestamp, does the timestamp meet the following requirement:
timestamp <= now <= timestamp + x_amz_expires
Or if an allowance for clocks being out of sync is made,
timestamp - fuzz <= now <= timestamp + x_amz_expires
If not, the request is invalid, possibly the result of a user bookmarking the ECP landing page on a
previous visit. The request should be rejected or discarded.
1. Are all parameters formatted in accordance with the descriptions?
2. Are all parameters required for the signature present in the request?
The first 1/3 of “verifyAwsUrlSignature” and the private method “validateQueryParms” in section
crypt_aws_s4.php on page 207 provide examples of performing these types of checks in PHP.
Extracting the Signature from the Request
The signature is in the “X-Amz-Signature” query string parameter. Obviously the signature itself can’t be
included in the computation of the signature so it must be removed from the request and set aside for
later comparison. How the signature is removed from the request will depend on the program language
and framework used to implement the external captive portal. The method
“simpleaws::verifyAwsUrlSignature” in crypt_aws_s4.php on page 207 illustrates one way to remove the
signature when the query parameters are in a PHP array.
Building the String to Sign
Figure 36 shows the main actions required to build the string that will be signed out of the request:
1. Build the scope string.
2. Build a “canonicalized” version of the request.
3. Assemble the scope string, the canonicalized string, and some additional inputs to create the string
to sign.
The scope string is easy to build out of a valid request. It is made from parts of the string in the “X-Amz-
Credentials” parameter. If the credentials are valid then the scope string can be created by un-escaping
the forward slashes it contains (i.e. replace ‘%2f’ with ‘/’), and then taking all the characters to the right
of the first forward slash. The scope ends up being the fully qualified credential, less the identity string.
External Captive Portal on a Third-Party Server
The Redirection URL Sent from Extreme Campus
Controller
Extreme Campus Controller Deployment Guide for version 5.46.03 101