Security

 View Only
last person joined: yesterday 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Expand all | Collapse all

Self Registration HTML error on Android devices

This thread has been viewed 18 times
  • 1.  Self Registration HTML error on Android devices

    Posted Aug 19, 2022 01:38 PM
    Hello,

    I have a customer that recently started getting complains from guest users saying the guest captive portal is "broken". Indeed, 3 different flavors of Android were tested and they all show this error message when opening the portal:

    The page at "guest.xxx.xxx" says:
    Internal form error: problem with element 'visible_if' or 'enable_if': Nwa_SetStyleDisplay is not defined

    Tests with iOS show no problems at all.

    This guest portal has been in use for a few months, and no configuration changes were done recently. The only change that I imagine could have brought this on was a ClearPass cluster update a few days ago: 6.9.6 to 6.9.12.

    The error message is indeed part of the Self Registration page code:

    document.formd7f7167a_guest_register.Nwa_OnFieldsChanged = function () {
        var form;
        try {
    
           form = document.getElementById("formd7f7167a_guest_register");
            if (typeof(form) !== 'object' || form === null) {
                return;
            }
            with (form) {
                Nwa_SetStyleDisplay("TR_formd7f7167a_guest_register_expire_after", (typeof(modify_expire_time) == "undefined" || modify_expire_time.value == "expire_after"));
    
           }
        } catch (e) {
            alert("Internal form error: problem with element 'visible_if' or 'enable_if': " + e.message)
        }
    }​


    I would like to know if anyone out there could help with:

    - Does this code snippet or something similar appear in Self Registration pages in ClearPass 6.9.6?
    - Any reasoning behind the browser error message? Why does it happen only on Android?

    Your help is appreciated!

    ------------------------------
    / Mike /
    ------------------------------


  • 2.  RE: Self Registration HTML error on Android devices

    EMPLOYEE
    Posted Aug 22, 2022 05:35 AM
    Do you have valid/trusted certificates installed? And are you running the portal over HTTPS? Captive portals on unencrypted HTTP are known to have issues with modern devices. If you see a certificate warning anywhere in your guest process, you probably need to fix that first.

    Message seems related to the expire_after field, which by default is hidden, and the Nwa_SetStyleDisplay should not even be called. Did you modify anything in the expire_after field?

    I tested on ClearPass 6.10.6 with Android 10, with Firefox, Chrome and de popup browser, but could not see that alert. Code looks similar in my deployment.

    EDIT: Please open a TAC case if you can't solve this. It doesn't look like a wide-spread issue.
    EDIT: I see one similar report, where there was an issue with custom HTML code in the guest page. That should not be introduced with an upgrade, but if you have customized HTML it may be good to remove it and see if the error disappears, then find what is wrong with the HTML and put it back. TAC can probably assist in that as well.

    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------



  • 3.  RE: Self Registration HTML error on Android devices

    Posted Aug 22, 2022 06:07 AM
    Hi Herman, and thanks for your answer.

    The portal is indeed running on HTTPS, with a valid public certificate, no issues there.

    To complicate matters, however, we have a WAF between clients and ClearPass. I do know they filter URIs, so maybe some specific URI has changed between versions?... Well, I have a meeting scheduled with the WAF guys this afternoon.

    If we don't find anything being blocked there I will open a TAC case.

    Thanks,

    ------------------------------
    / Mike /
    ------------------------------



  • 4.  RE: Self Registration HTML error on Android devices

    Posted Aug 22, 2022 09:50 AM
    Problem solved!

    The WAF was allowing/blocking URIs based on strings; the update on ClearPass changed some of them. Example:

    6.9.6 >>>>  /guest/js/jquery.min-1598269532.js
    6.9.12 >>>  /guest/js/jquery.min-1637732183.js

    The allowed URIs were adapted, and everything works now.

    Some unexplainable things for me:

    - How does this relate to the error message seen on Android devices.
    - Why iOS devices didn't show any error.

    I'm sure someone really dedicated could find out, but it seems pointless now.

    ------------------------------
    / Mike /
    ------------------------------



  • 5.  RE: Self Registration HTML error on Android devices

    EMPLOYEE
    Posted Aug 22, 2022 10:22 AM
    Ah, that is quite logical. jquery is basis of many interactive web-pages. The number has to do with the version, and reason to give different versions a different name is to avoid caching, that clients use an old version of jquery.min.js after an update/upgrade of the application (ClearPass in this case). The WAF should allow any number there (jquery.min*.js) to avoid this in the future, under the assumption that there will be no further changes in scripts/naming.

    Many browsers will suppress/ignore popups, which probably is the reason why. Android apparently shows/allows alert/popup, where the other devices suppress them. It can be that you see a small option in the URL bar to allow popups.

    Glad you found it.

    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------