Security

last person joined: yesterday 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

To hide the ap-name and ap-group name from the captive-portal URL?

This thread has been viewed 1 times

  • 1.  To hide the ap-name and ap-group name from the captive-portal URL?

    Posted Sep 30, 2016 07:27 PM

    Hello, 

     

    On getting redirected to the captive-portal page, i have information of the client-mac, client-ip, ap-name, ap-group, essid, url typed by the user, in the redirected URL. 

     

    Is there any possible way to hide those information in the URL?



  • 2.  RE: To hide the ap-name and ap-group name from the captive-portal URL?

    EMPLOYEE
    Posted Sep 30, 2016 09:59 PM

     

    It is not possible at this time.  Please enter a request to hide it here:  https://arubanetworkskb.secure.force.com/cp/ideas/ideaList.apexp



  • 3.  RE: To hide the ap-name and ap-group name from the captive-portal URL?

    Posted Oct 05, 2016 03:08 PM

    what is the purpose of having those information in the redirected url.?



  • 4.  RE: To hide the ap-name and ap-group name from the captive-portal URL?

    EMPLOYEE
    Posted Oct 05, 2016 04:44 PM
    Guest management solutions can use this data on the backend.


  • 5.  RE: To hide the ap-name and ap-group name from the captive-portal URL?

    EMPLOYEE
    Posted Apr 15, 2019 06:31 PM

    Hi Colin/Tim,

     

    Any update on this old topic?

     

    I get asked this question once in a while.

     

    I know why we need this info in the ClearPass guest solution, but is there a way to hash data or use a session id or something?

     

    Cheers



  • 6.  RE: To hide the ap-name and ap-group name from the captive-portal URL?

    EMPLOYEE
    Posted Apr 15, 2019 06:35 PM
    This data is sent by the controller. ClearPass just consumes it. I’m not aware of any way to disable it.


  • 7.  RE: To hide the ap-name and ap-group name from the captive-portal URL?
    Best Answer

    EMPLOYEE
    Posted Apr 16, 2019 09:40 AM

    Assuming you are not using the Security Hash feature, which protects those fields from hacked overrides, create a Web Page with the following and set it as your captive portal landing page:

     

    Skin: Blank Skin

    HTML:

    {capture name=url}https://YOUR_DOMAIN/guest/YOUR_PAGE.php{/capture}
    <html>
    <head>
    <meta http-equiv="refresh" content="0; URL='{$smarty.capture.url|trim}'" />
    </head>
    <body><a href="{$smarty.capture.url|trim}">{$smarty.capture.url|escape}</a></body>
    </html>

     

    Your logins should work without any problems.



  • 8.  RE: To hide the ap-name and ap-group name from the captive-portal URL?

    EMPLOYEE
    Posted Apr 24, 2019 03:44 PM

    Hi Garth,

     

    Thanks for that. Do you know a way to use the Security Hash and this URL strip/rewrite?

     

     



  • 9.  RE: To hide the ap-name and ap-group name from the captive-portal URL?

    EMPLOYEE
    Posted Apr 26, 2019 11:02 AM

    Looking at the code again, it may work.  You need to ensure a page with hashing enabled is never accessed with a passed parameter and not the hash, as it will invalidate the session.  The application log will tell you when it is rejecting stuff.  Search 'tamper'.



  • 10.  RE: To hide the ap-name and ap-group name from the captive-portal URL?

    EMPLOYEE
    Posted Oct 28, 2019 11:45 AM

    hash url not work for hide ap-group etc. infomation.



  • 11.  RE: To hide the ap-name and ap-group name from the captive-portal URL?

    EMPLOYEE
    Posted Oct 28, 2019 11:47 AM

    This method can be temporarily hidden, but the capture still shows the truth information. any better  way?