Guest Wireless Management System

1

• Guest Wireless Management System
• Mathew Mathai (mathew.mathai_at_vt.edu)
• Network Infrastructure Services
• Information Technology, Virginia Tech

VA SCAN 2008
2
Agenda

• Guest Wireless Management System
• Background
• Design
• Process
• Questions

3
Background
Before Guest Wireless Management System
Blue Socket network appliance to prevent
unauthorized access
Guest
Auth Info
TACACS

• Guest credentials had to be manually added to
  Auth system
• No easy way to recover cost for services
  provided to guests

4
Background (2)
Guest Wireless Management System
Guest Wireless Management System
Auth Info
TACACS

• Objectives
• Improve the process of providing guests access
  to the wireless network
• Cost recovery

5
Design

• Users
• Guests non VT affiliates
• Sponsors VT affiliates (responsible party)
• Help Desk Personnel
• Process
• Guests manage identity information and request
  service
• Sponsors manage requests approve/deny

6
Design (2)

• Guest
• Create/manage account (can not delete account)
• Email address (userid)/Password
• Name, Address, Telephone Number, Secret Questions
• Status
• Provisional (email not confirmed)
• Good (email confirmed)
• Request wireless service
• Respond to invitations from sponsor

7
Design (3)

• Sponsor
• Approve/deny guest requests
• Create calendar profiles (multiple service
  periods)
• Send invitations to guest
• Create guest accounts (different status)
• Create service on behalf of guest
• Reset guest account passwords

8
Design (4)

• Help Desk
• Reset guest account password
• View list of sponsors and contact them if needed
• Archive provisional guest accounts (to prevent
  potential denial of service)
• Create service on behalf of guest

9
Process
Guest
Sponsor
Guest
Auth Group
TACACS
4HELP

• Guest creates account (once)
• Guest requests service
• Sponsor approves request
• BusSys adds/deletes userid to/from on NE AuthZ
  Group at service activation/deactivation

• Guest Logs on to Blue Socket (through a Web
  browser)
• Blue Socket passes credentials to RADIUS which
  talks to TACACS
• TACACS makes auth (N and Z) calls to NE system
• Returns yea or nay to RADIUS

10
Conclusion

• Usability
• Password reset
• Simple URL
• Invitations
• Calendar profiles
• Usage
• 4000 guest accounts
• 90 sponsors
• 6000 service requests