SAML for the Captive Portal

Captive Portal SAML signs guests in through the Organization’s Self-Service identity provider (IdP). Setting up that IdP is the same as for the Self-Service Portal, and is described under Organization:

• How SAML works and SAML configuration: the platform side.
• Microsoft Entra ID: the Entra side, step by step.
• SAML signing certificate: keeping the IdP in step when the platform’s certificate changes.

On the Sign-In Context, the SAML SSO module adds SAML as a sign-in option on the Captive Portal, and the Access Policies decide which guests are let in. This page covers the two things that only matter on the Captive Portal: the walled garden and MFA.

Walled garden

Until a guest has signed in, their device can only reach the destinations in the walled garden. The IdP’s sign-in pages have to be among them, or the redirect to the IdP never loads.

• Service Gateway: under Administration → Configuration → Common Settings → Service Gateway Walled Garden, the buttons Add Azure iDP entries, Add Google iDP entries and Add Okta iDP entries add the hostnames listed below.
• Cisco Meraki: add the hostnames to the walled garden in the Meraki dashboard.
• Both: a mixed deployment needs both.

A change can take a few minutes to take effect.

Microsoft Entra ID

• login.microsoftonline.com
• myapps.microsoft.com
• account.live.com
• aadcdn.msauth.net
• aadcdn.msftauth.net
• account.activedirectory.windowsazure.com

Google Workspace

• accounts.google.com
• accounts.google.se, or the country domain Google sends your users to. Add one entry per country domain in use.
• fonts.gstatic.com
• ssl.gstatic.com
• lh3.googleusercontent.com
• accounts.youtube.com

Okta

• login.okta.com
• ok12static.oktacdn.com
• Your own Okta domain, for example your-company.okta.com. The button does not add it, so add it yourself.

For any other IdP, check its documentation for the hostnames its sign-in pages load from.

Disabling MFA for the Captive Portal

MFA can block Captive Portal sign-in: many devices do not allow switching apps while the captive sign-in window is open, so the guest cannot open an authenticator app to approve the prompt.

In Microsoft Entra ID, use a Conditional Access policy that requires MFA for all resources except the application the Captive Portal signs in through.

1. Move from per-user MFA to Conditional Access

   Per-user MFA applies to every application and cannot exclude one. If your tenant still uses it, check under Entra ID → Users → Per-user multifactor authentication that the status is Disabled for the users the new policy will cover. Microsoft recommends Conditional Access MFA instead of per-user MFA.

2. Create a policy

   Go to Entra ID → Conditional Access → Policies and click New policy. Give it a clear name, for example Require MFA except Captive Portal.

3. Users

   Include All users.

4. Target resources

   Include All resources (called All cloud apps in older tenants), and exclude the enterprise application you created for the Self-Service configuration.

5. Grant

   Choose Grant access, tick Require multifactor authentication and click Select.

6. Enable

   Set Enable policy to Report-only for a dry run, or to On, and click Create.

Note

The Captive Portal and the Self-Service Portal sign in through the same application, so the exclusion also removes MFA from Self-Service Portal sign-in. Agree on the exclusion with your security team.

For other IdPs, see their documentation for excluding a single application from MFA.

Troubleshooting

Symptom	Most likely cause
The IdP sign-in page never loads, or the browser loops back to the Captive Portal	IdP hostnames missing from the walled garden.
The guest gets an MFA prompt they cannot complete	MFA applies to the Captive Portal application; see above.
Sign-in at the IdP works, but the guest gets no network access	No matching Access Policy lets SAML guests through. See SAML SSO: who gets through.
The IdP shows an error before returning to the portal	An IdP-side configuration problem, the same as for the Self-Service Portal. See Organization diagnostics.

For other Sign In Module problems, see Sign In Module issues.

Related

SAML SSO module

Putting SAML on the Captive Portal of a Sign-In Context.

Walled garden

Pre-auth reachability in general.

Microsoft Entra ID

Setting up the enterprise application.

SAML configuration

The SAML configuration Captive Portal sign-in uses.