Hi Christian,
You have two options of doing this. Radius based or authentication text based.
Let's assume, you have a radius server in the background. The portal needs to send back the information for username and password to the IAP. I created a sample pae for this:
<!doctype html>
<html lang="de">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>External Captive Portal with Username</title>
</head>
<body>
<form method="POST" action="https://securelogin.arubanetworks.com/swarm.cgi">
<input type="hidden" name="cmd" value="authenticate" />
User Name: <br/> <input type="text" name="user" id="user"/>
<br/>
Password: <br/> <input type="password" name="password" id="password"/>
<br/>
<input type="submit" value="Login"/>
</form>
</body>
</html>
After the IAP gets the username pasword it uses the radius server to authenticate the user.
I have created a description on my personal blog, have a looke here:
https://www.flomain.de/2016/12/aruba-instant-with-external-captive-portal/
BR
Florian