As of ArubaOS 6.5, you can send a radius reply message attribute that will be displayed both on internal and external captive portals. You would just have to send a reject as usual from the radius server, but populate the reply-message attribute.
http://www.arubanetworks.com/techdocs/ArubaOS/6.5.x.x/Default.htm#ReleaseNotes/FeaturesIn6.5.xReleases/Features6.5.x.htm%3FTocPath%3D_____2
![Screenshot 2017-07-19 at 09.14.58.png Screenshot 2017-07-19 at 09.14.58.png](https://higherlogicdownload.s3.amazonaws.com/HPE/MigratedInlineFiles/17829739a501458d888fae90212fe969_d899511c26a941f4ae6bde1b4135def9)
Here is how a rejection mesage looks on internal cp:
![Screenshot 2017-07-19 at 09.16.00.png Screenshot 2017-07-19 at 09.16.00.png](https://higherlogicdownload.s3.amazonaws.com/HPE/MigratedInlineFiles/17829739a501458d888fae90212fe969_d78e3d22a4b24af592f5e46d02952518)
Here's how a rejection message looks on an external captive portal, like clearpass:
![Screenshot 2017-07-19 at 09.16.24.png Screenshot 2017-07-19 at 09.16.24.png](https://higherlogicdownload.s3.amazonaws.com/HPE/MigratedInlineFiles/17829739a501458d888fae90212fe969_da3ee6f4582548ba8416cd672932d487)
You would just have to return the radius reply-message attribute with either a positive or negative auth.
When it is added to a positive authentication, the message is displayed on the "welcome" screen of captive portal:
![Screenshot 2017-07-19 at 09.19.18.png Screenshot 2017-07-19 at 09.19.18.png](https://higherlogicdownload.s3.amazonaws.com/HPE/MigratedInlineFiles/17829739a501458d888fae90212fe969_86bec575f5da4b4188a31ac94f3ce4c0)
To enable logging to look at what reply message has been received, you can type:
config t
logging level debugging system process httpd subcat webserver
You would then type "show log system 50", and the message might look like this:
Failure:
Jul 19 02:49:16 :32674: <399828> <DBUG> |httpd| |webserver| aruba-login.c:612) User:2001:470:ed6c:0:a9ac:30c0:359e:903c - Auth result 1 reason Authentication failed, as password is wrong on server1
Success:
Jul 19 02:53:09 :922: <399828> <DBUG> |httpd| |webserver| aruba-login.c:740) User:2001:470:ed6c:0:a9ac:30c0:359e:903c - Internal welcome success message User has authenticated successfully from first server1
I hope that helps.