Deployment Guide

Table 13: Parameters that can be included in a Signed Redirection Response from the
ECP (continued)
Parameter
Name
Parameter Value Mandatory Notes
X-Amz-
Credential
Alpha-numeric
string
Yes The identifier for the account whose shared secret
was used to compute the “X-Amz-Signature”.
Mandatory if the ECP signs the redirection
response in order to act as the final authorizing
authority. The credential has the format:
<identity>/<YYYYMMDD>/world/ecp/
aws4_request
where:
• <identity> is the identity configured for the
ECP on the appliance in the WLAN Service’s
ECP configuration.
• <YYYYMMDD> is the year, month, and day
extracted from X-Amz-Date.
• world/ecp/aws4_request is a constant literal
string that scopes the request.
X-Amz-Date Alpha-numeric
string
Yes This is the date and time at which the appliance
prepared and sent the redirection back to the
user’s browser. The date and time are in ASCII-
encoded UTC and has the format:
YYYYMMDDThhmmssZ
This attribute must be present if the ECP signs the
redirection response to indicate that it is the final
authorizing authority.
X-Amz-
Expires
Numeric String Yes This is the maximum length of time in seconds
that the appliance should trust the redirection
response. In other words a signed redirection
response from the ECP will be treated as valid
only until X-Amz-Date + X-Amz-Expires.
This attribute is mandatory if the ECP signs the
redirection response.
X-Amz-
Signature
ASCII-encoded
hex string
Yes This is the signature computed over some of the
HTTP headers and parts of the query string,
presented as ASCII encoded-hex.
The field must be present if the ECP signs the
request in order to act as the final authorizing
authority.
X-Amz-
SignedHeader
s
Alpha-numeric
String
Yes Which of the headers in the HTTP request were
included in the input to the calculation of the
signature.
This is present only when the appliance is
configured sign the redirection to the ECP, in
which case it must be present.
Related Topics
Signing the Redirection to Extreme Campus Controller on page 106
Case 1: When a RADIUS Server Authenticates the Client on page 107
External Captive Portal on a Third-Party Server
Case 2: When the ECP is the Final Authority
Extreme Campus Controller Deployment Guide for version 5.46.03 111