Techniques for providing full-featured browser access during captive portal authentication routines
The present disclosure is generally directed to a method and system for authentication with a computer network that comports with CNA requirements, but utilizes a bypass approach that allows for authentication to be completed within a full-featured browser. In an embodiment, an access point (AP) may be configured to allow for user devices to associate and detect the presence of a captive portal. However, during the CNA messaging sequence, the AP can provide a CNA bypass message that causes the CNA browser instantiated on the user device to consider the authentication complete without having to satisfy authentication requirements. Based on the CNA bypass message, the user device may then transition to a full-featured browser to complete authentication via a captive portal. Authentication may be completed by, for example, watching at least a portion of a video, playing a video game, taking a quiz, and/or entering identifying information.
1. A method of providing a captive portal authentication scheme on a computer network, the method comprising:
receiving, by a controller, a first captive portal detect message from a user device and sending a message with an identifier of a captive portal location to the user device;
receiving, by the controller, a second captive portal detect message from the user device and sending a captive network assistant (CNA) bypass message to the user device, the CNA bypass message to cause the user device to transition a CNA feature-constrained browser to a full-featured browser to complete authentication with an authentication provider associated with the network, and wherein the CNA bypass message is sent by the controller without receiving an indication of user input being supplied in the CNA feature-constrained browser; and
receiving, by the controller, a message from the user device indicating one or more authentication requirements were satisfied via the full-featured browser, and in response to the receiving the message, completing authentication of the user device via the authentication provider to allow the user device to access content via the network beyond the captive portal.
2. The method of claim 1 , wherein the CNA feature-constrained browser has limited capabilities relative to the full-featured browser.
3. The method of claim 1 , wherein the one or more authentication requirements include at least one of watching at least a portion of a video, playing a game, solving a puzzle, and/or providing identifying information.
4. The method of claim 1 , wherein the CNA feature-constrained browser is implemented at an operating system (OS)-level.
5. The method of claim 1 , wherein the CNA bypass message includes a redirect uniform resource locater (URL).
6. The method of claim 1 , wherein the computer network is a Wi-Fi network, and wherein the controller is implemented in an access point or a gateway device associated with the Wi-Fi network.
7. The method of claim 1 , wherein the authentication provider is implemented by the controller.
8. The method of claim 1 , wherein the authentication provider is implemented by a remote computing device.
9. The method of claim 1 , wherein the authentication provider is implemented as a Radius server that supports an authentication, authorization, and accounting (AAA) protocol.
10. A network authentication system, the network authentication system comprising:
a gateway device, the gateway device having a controller and a network interface circuit coupled to the controller to initiate a network authentication process with an associated user device, the network authentication process including the gateway device sending a captive network assistant (CNA) bypass message to the associated user device, the CNA bypass message to cause the user device to transition a CNA feature-constrained browser to transition from the CNA feature-constrained browser to a full-featured browser to complete authentication,
wherein the CNA bypass message is sent by the controller of the gateway without receiving a message that indicates user input was supplied in the CNA feature-constrained browser.
11. The network authentication system of claim 10 , further comprising an authentication provider, the authentication provider being implemented as a Radius server that utilizes an authentication, authorization, and accounting (AAA) protocol, and wherein authentication by the full-featured browser includes communicating with the authentication provider.
12. The network authentication system of claim 10 , wherein authentication by the full-featured browser includes satisfying one or more authentication requirements, the one or more authentication requirements including at least one of watching at least a portion of a video, playing a game, solving a puzzle, and/or providing identifying information.
13. The network authentication system of claim 10 , wherein the gateway device includes access point functionality, and wherein the gateway device allows for user devices to associate via Wi-Fi.
14. A non-transitory computer-readable medium having a plurality of instructions encoded thereon that when executed by at least one processor cause a process to be performed, the process configured to:
receive a captive portal detect message from a user device; and
in response to receiving the captive portal detect message sending a CNA bypass message to the user device, the CNA bypass message to cause the user device to transition a CNA feature-constrained browser to a full-featured browser to complete authentication with an authentication provider,
wherein the CNA bypass message is sent without receiving a message that indicates user input was supplied in the CNA feature-constrained browser.