Introduction
RADIUS (Remote Authentication Dial-In User Service) is a widely used authentication, authorization, and accounting protocol for controlling network access. Operating on a client-server model, it validates credentials, defines permissions, and records user activities, ensuring security and efficient management. In our case, we exclusively use RADIUS to manage CoffeeBean's Wi-Fi environments, providing secure and controlled access for users and devices.
Architecture
The integration of the Captive Portal and the CoffeeBean platform is illustrated in the following diagram:
As soon as the user connects to a Wi-Fi network, the AP (Access Point) or controller redirects them to the Captive Portal page. The user can log in using a social network or traditional credentials, and the social login callback sends the user's credentials to the AP or controller. The AP or controller must be configured to authenticate users via RADIUS authentication.
A RADIUS server and a client secret are configured and used when an authentication request is received. The social login RADIUS server authenticates the user and responds to the AP/controller, which grants internet access and redirects the user to a welcome page or portal. From that moment on, the user can enjoy free internet access.
Configuration Parameters
To configure the captive portal in most vendors, you will need the following basic parameters:
- RADIUS server host or IP address: the hostname or IP address of the CoffeeBean RADIUS server responsible for authenticating users.
- RADIUS server authentication and accounting ports: the authentication port of the CoffeeBean RADIUS server, responsible for authenticating users, and the accounting port of the CoffeeBean RADIUS server, responsible for collecting usage information.
- RADIUS client secret: the shared secret key between the client and the RADIUS server, provided by the CoffeeBean team.
- Captive portal URL: the URL of the external login page to which users will be redirected.
RADIUS Server
The RADIUS server can be configured by hostname or IP address. We recommend using the hostname instead of the IP address, if possible.
If the client's infrastructure uses static IPs, we provide the following servers per environment:
| Environment | Region | Type | Hostname | IP | Authentication port | Accounting port |
|---|---|---|---|---|---|---|
| production | sa-east | primary | radius.socialidnow.com | 54.94.140.247 | 1812 | 1813 |
| production | sa-east | secondary | radius2.socialidnow.com | 54.207.239.113 | 1812 | 1813 |
| production | eu-central | primary | radius.eu-central.socialidnow.com | 52.28.85.158 | 1812 | 1813 |
| staging | us-east | primary | radius-staging.socialidnow.com | 178.128.135.142 | 1812 |
1813 |
For dynamic IPs, when the client's network does not support static IPs, we provide a RADIUS server that acts as a proxy:
| Environment | Region | Type | Hostname | IP | Authentication port | Accounting port |
|---|---|---|---|---|---|---|
| production | sa-east | primary | radius-proxy.socialidnow.com | 18.228.102.200 | custom | custom |
| production | sa-east | secondary | radius-proxy2.socialidnow.com | 18.229.36.64 | custom | custom |
| staging | us-east | primary | radius-staging.socialidnow.com | 178.128.135.142 | custom | custom |
For these cases, we will configure custom ports for authentication and accounting, in addition to a unique client secret for each client.
Our RADIUS servers accept the following authentication protocols: PAP, CHAP, MS-CHAP, MS-CHAPv2, and EAP types.
RADIUS Client Secret and Captive Portal URL
These parameters are specific to each client. Please contact us for more details.