Deployment Guide

Where:
• GET is the request type. For FF-ECP this will always be the literal “GET.”
• <URL-Path-Component> is the substring beginning with the ‘/’ at the end of the host or host-
plus-port portion of the URL and either the end of the URL or the ‘?’ marking the beginning of the
query parameter string. For example, the URL-Path-Component of https://
192.168.18.152:5825/adir/bdir/cdir/resource.htm?x=7&y=gg is /adir/bdir/
cdir/resource.htm
• <URL-Query-Parameters> is the substring following the ‘?’ character and extending either to
the end of the URL or up to but not including the ‘#’ fragment character.
• <URL-Host> is the host portion of the URL string. It excludes any port number included in the URL.
In the preceding URL, the URL-Host is 192.168.18.152.
• ‘.’ is the catenation operator.
• The remaining components are literals that should be added to the string as-is.
Finally the string that will actually be signed is composed as:
"AWS4-HMAC-SHA256\n"
.<Date>."\n"
.<scope>."\n"
.sha256(<canonicalized-request-string>)
where
• AWS4-HMAC-SHA256 is a literal identifying the overall signing algorithm being used.
• <Date> is the value of the “X-Amz-Date” parameter extracted from the redirected request.
• <Scope> is the scope string that was assembled as described above.
• <canonicalized-request-string> is the canonicalized request string assembled as
described above.
• sha256() is a procedure that applies the standard sha256 algorithm to the canonicalized-request-
string. Its output should be in the form of a string of lowercase hex digit characters.
Creating the Signing Key
The process for generating signatures uses symmetric key encryption. The controller and the ECP use a
shared key (the one configured on the controller’s WLAN Service’s captive portal configuration dialog)
and the same encryption algorithm to generate and validate the signature.
The shared key is not used directly. Instead it is used to generate a secure hash (“HMAC”) that is then
used as the key to sign the request. The process for creating the key is shown below in Figure 37.
External Captive Portal on a Third-Party Server
The Redirection URL Sent from Extreme Campus
Controller
Extreme Campus Controller Deployment Guide for version 5.46.03 103