Deployment Guide

// External Captive Portal" support enabled.
// This script is responsible for collecting critical
// information from the redirection, such as the
// session token, and for constructing the login page
// for the user. The script reads the VNS attribute
// from the redirected request so that the script can
// display it on the login page.
//
// The script expects the controller to sign the
// redirection response. The script validates the
// signature. If the signature is valid, it displays
// the login page. Otherwise, it displays an error page.
//
// Assumptions
// ===========
// 1. The controller is configured to include its IP address
// and port in the redirection URL.
// 2. The controller is configured to sign its redirection
// responses using the Amazon S3 version 4 signature
// algorithm (as of May 2014).
// 3. The controller is configured to include the VNS in its
// redirection response.
// 4. This application assumes that the Identity & Shared Key
// key pairs that it is allowed to use are stored in an associative
// array. It also assumes that some configuration options such
// as the 'service' and 'region' are stored in another associative
// array. Real applications might retrieve this information from
// a database or configuration file.
require_once("ffecp_config.php");
require_once("crypt_aws_s4.php");
require_once("common_utilities.php");
// Mainline processing starts here. Utilities are defined after
// the mainline.
// 1. Verify that the request has all necessary fields
// and a valid signature.
$rc = SimpleAws::verifyAwsUrlSignature(getURL($_SERVER),
$awsKeyPairs);
if (SimpleAws::AWS4_ERROR_NONE != $rc) {
printError(SimpleAws::getAwsError($rc));
exit;
}
// Determines which controller interface to interact with
if(isset($_REQUEST['hwc_ip']) && isset($_REQUEST['hwc_port'])) {
//BM IP address and port is enabled
$hwc_ip = trim($_REQUEST['hwc_ip']);
$hwc_port = trim($_REQUEST['hwc_port']);
} else {
// The controller has not been configured as expected. It did not
// include its address and port on the redirection URL. This is
// easy to fix but all this program can do is report the error.
printError("Controller must be configured to include its IP " .
"address & port in the request.");
exit;
}
// Collect the data required by the login page and
// subsequent authentication.
$dest = isset($_REQUEST['dest']) ? $_REQUEST['dest'] : "";
$bssid = isset($_REQUEST['bssid']) ? $_REQUEST['bssid'] : "";
$wlan = isset($_REQUEST['wlan']) ? $_REQUEST['wlan'] : "";
$vns = isset($_REQUEST['vns']) ? $_REQUEST['vns'] : "";
$mu_mac = isset($_REQUEST['mac']) ? $_REQUEST['mac'] : "";
$ap_name = isset($_REQUEST['ap']) ? $_REQUEST['ap'] : "";
net-auth.php
PHP External Captive Portal, Controller’s Firewall
Friendly API
198 Extreme Campus Controller Deployment Guide for version 5.46.03