Custom authentication

[maoudia-via]

Important notices

Our forum is located at https://forum.opnsense.org , please consider joining discussions there in stead of using GitHub for these matters.

Before you ask a new question, we ask you kindly to acknowledge the following:

• [x] I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• [x] I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

I am try to understand the feasibility of using a custom authentication mechanism for Captive Portal. My goal is to :

• Host my own page for a Captive Portal.
• Authenticate users through our own authentication mechanism (LDAP and RADIUS are a no-go). I just want OpnSense Captive portal to make an HTTPS request to verify authentication status for a particular MAC address. I am also open to any other interaction mechanism.
• Use external backend services (hosted on different, accessible parts of the network) to perform authentication.

I would like to know:

• Is there a fundamental reason this would be impossible with OpnSense ?
• Is it just a matter of modifying the Captive Portal Page template to host my page?
• Is this something that should be implemented through a plugin ? Thank you !

[fichtner]

You can build pluggable authentication method easily:

https://docs.opnsense.org/development/components/authentication.html

Cheers, Franco

[maoudia-via]

Thank you for the quick response. So in the Captive Portal configuration, this would appear as another authentication method . Correct ?

[AdSchellevis]

When configured… same as any other type

[maoudia-via]

Thank you !

[maoudia-via]

One follow up question as I am new to development in OpnSense : I see the existing authentication classes are under src/opnsense/mvc/app/library/OPNsense/Auth/Radius.php in Core. Is it necessary to build a new image with the addition of the new Authentication class or can the authentication class be added as a plugin ?

[fichtner]

Plugin makes more sense, but for custom deployments just dropping the file in the target system is more than enough.