Deployment Guide
Table Of Contents
- Table of Contents
- Preface
- About Extreme Campus Controller Deployment
- Configuring DHCP, NPS, and DNS Services
- Centralized Site with a Captive Portal
- Centralized Site with AAA Network
- Deploying a Mesh Network
- Configuring an External NAC Server for MBA and AAA Authentication
- Manage RADIUS Servers for User Authentication
- External Captive Portal on a Third-Party Server
- Access Control Rule Admin Portal Access
- Deploying Centralized Web Authentication
- Deploying ExtremeCloud IQ - SE as an External Captive Portal
- Deployment Strategy
- Configuring an External Captive Portal Network
- Editing the Configuration Profile for Network and Roles
- Extreme Campus Controller Default Pass-Through Rule
- Adding Extreme Campus Controller as a Switch to ExtremeCloud IQ - Site Engine
- Editing the Unregistered Policy on ExtremeCloud IQ - Site Engine
- Editing the ExtremeCloud IQ - Site Engine Profile for Policy and Location-Based Services
- Deploying an ExtremeGuest Captive Portal
- Deploying Client Bridge
- Deploying an Availability Pair
- Deploying Universal APs
- Extreme Campus Controller Pair with ExtremeLocation and AirDefense
- ECP Local Authentication
- PHP External Captive Portal, Controller’s Firewall Friendly API
- Index
Table 11: Parameters Available on the Redirection URL from Extreme Campus
Controller to the ECP (continued)
Parameter
Name
Parameter Value Required Notes
X-Amz-Date Alphanumeric
String
No This is the time at which the appliance prepared
and sent the redirection back to the user’s
browser. The date and time are in ASCII-encoded
UTC.
This attribute is present if a time stamp or a
signature is requested. It can be used to identify
stale or replayed URLs. If the appliance is
configured to sign the request this must be
included in the redirection response (and the
browser’s redirected request).
X-Amz-
Expires
Numeric String No This is the maximum length of time in seconds to
trust the request. In other words the web request
is only good until X-Amz-Date + X-Amz-Expires.
After that time the URL should not be trusted as
it is highly likely to have been replayed.
This attribute is present only when the appliance
is configured to sign the redirection to the ECP,
in which case it must be present.
X-Amz-
Signature
ASCII-encoded
hex string
No This is the signature computed over some of the
HTTP headers and parts of the query string,
presented as ASCII encoded-hex.
The field is present only when the appliance is
configured to sign the request.
X-Amz-
SignedHeader
s
Alphanumeric
String
No Which of the headers in the HTTP request were
included in the input to the calculation of the
signature.
This is present only when the appliance is
configured sign the redirection to the ECP, in
which case it must be present.
Verifying the Signed Request
When the controller is configured to include signatures, it is easy for the ECP to ignore them. The ECP
simply extracts the information it is interested in from the provided attributes and ignores the rest.
However, it is highly likely that an administrator that enables response signing wants to use the
signatures to authenticate the redirected requests it receives. This section covers how to do that. The
whole process is shown in Verifying a Signed Request Basic Validation Checks on page 101.
The algorithm used to sign the redirection response (and therefore the redirected request to the ECP) is
based on Amazon Web Services API Signature Version 4. AWS documentation refers to this approach
as “Pre-signed URLs”.
The Redirection URL Sent from Extreme Campus
Controller External Captive Portal on a Third-Party Server
98 Extreme Campus Controller Deployment Guide for version 5.46.03