Authentication Providers

Authentication providers determine how users log in to your captive portal. You can enable multiple providers (email, social login, SMS, vouchers, SAML, or payment) to give users options that match your venue and audience.

Quick Start

Open your Captive Portal settings
Navigate to Authentication Providers
Click Add Provider
Select provider type (Email, Social, SMS, etc.)
Configure provider-specific settings
Add required domains to your Walled Garden
Test authentication flow

Provider Comparison

Choose the right authentication method for your use case:

Provider	User Friction	Data Collected	Best For	Setup Complexity
Email	Low	Email, optional name	Marketing, newsletters	Simple
Google	Very Low	Email, name, profile	General public	Moderate
Facebook	Very Low	Email, name, profile	Cafés, retail	Moderate
LinkedIn	Low	Email, name, company	Business venues, co-working	Moderate
Twitter/X	Low	Username, name	Events, media	Moderate
Apple	Very Low	Email (may be hidden)	Privacy-conscious users	Complex
SMS	Medium	Phone number	High security, verification	Moderate
Voucher	Low	None (pre-registered)	Hotels, events, controlled access	Simple
Username/Password	Medium	Credentials	Returning users, membership	Simple
SAML/SSO	Very Low	Enterprise profile	Corporate, education	Complex
Payment	High	Payment + contact info	Paid WiFi, premium access	Moderate

Quick Selection Guide

Maximize sign-ups (lowest friction):

Google + Facebook + Email

Collect marketing data:

Email (with custom fields) + Social login

Enterprise/Corporate:

SAML + Email (for visitors)

Hotels/Hospitality:

Voucher (room guests) + Payment (day visitors)

Events/Conferences:

Voucher (pre-registered) + SMS (walk-ins)

High security requirements:

SMS + SAML

Available Providers

Email Authentication

Users enter their email address to receive access or a verification link.

Configuration:

Enable email verification (sends confirmation link)
Set email validity period
Customize email template

Use cases:

Marketing data collection
Simple guest access
Email-based promotions

Email Template Customization

Customize the emails sent to users with HTML templates and variables.

Available Variables:

Variable	Description
`{{username}}`	User's email address
`{{fullname}}`	User's full name (if collected)
`{{verification_link}}`	Email verification URL
`{{verification_code}}`	Numeric verification code
`{{network_name}}`	WiFi network SSID
`{{portal_name}}`	Captive portal name
`{{expiry_time}}`	Link/code expiration time
`{{company_name}}`	Your company name

Welcome Email Template Example:

<!DOCTYPE html>
<html>
<head>
  <style>
    body { font-family: Arial, sans-serif; line-height: 1.6; color: #333; }
    .container { max-width: 600px; margin: 0 auto; padding: 20px; }
    .header { background: #0066cc; color: white; padding: 20px; text-align: center; }
    .content { padding: 30px; background: #f9f9f9; }
    .button { display: inline-block; padding: 12px 30px; background: #0066cc;
              color: white; text-decoration: none; border-radius: 5px; }
    .footer { padding: 20px; text-align: center; font-size: 12px; color: #666; }
  </style>
</head>
<body>
  <div class="container">
    <div class="header">
      <h1>Welcome to {{network_name}}</h1>
    </div>
    <div class="content">
      <p>Hello {{fullname}},</p>
      <p>Thank you for connecting to our WiFi network. Please verify your email
         address to complete your registration.</p>
      <p style="text-align: center; margin: 30px 0;">
        <a href="{{verification_link}}" class="button">Verify Email</a>
      </p>
      <p>Or enter this code on the login page: <strong>{{verification_code}}</strong></p>
      <p>This link expires in {{expiry_time}}.</p>
    </div>
    <div class="footer">
      <p>&copy; {{company_name}} | <a href="{{privacy_url}}">Privacy Policy</a></p>
    </div>
  </div>
</body>
</html>

Password Reset Email Template:

<!DOCTYPE html>
<html>
<head>
  <style>
    body { font-family: Arial, sans-serif; line-height: 1.6; }
    .container { max-width: 600px; margin: 0 auto; padding: 20px; }
    .alert { background: #fff3cd; border: 1px solid #ffc107; padding: 15px;
             border-radius: 5px; margin: 20px 0; }
  </style>
</head>
<body>
  <div class="container">
    <h2>Password Reset Request</h2>
    <p>Hello {{username}},</p>
    <p>We received a request to reset your password for {{network_name}}.</p>
    <p style="text-align: center; margin: 30px 0;">
      <a href="{{reset_link}}" style="display: inline-block; padding: 12px 30px;
         background: #dc3545; color: white; text-decoration: none; border-radius: 5px;">
        Reset Password
      </a>
    </p>
    <div class="alert">
      <strong>Didn't request this?</strong> You can safely ignore this email.
      Your password will not be changed.
    </div>
    <p>This link expires in 1 hour.</p>
  </div>
</body>
</html>

Email Domain Restrictions

Control which email domains can register:

Allow List (Whitelist): Only allow specific domains (e.g., corporate emails only):

example.com
company.org
partner.net

Block List (Blacklist): Block disposable/temporary email providers:

mailinator.com
tempmail.com
guerrillamail.com
10minutemail.com
throwaway.email

Configuration:

Navigate to Captive Portal > Authentication Providers > Email
Enable Domain Restrictions
Select Allow List or Block List mode
Enter domains (one per line)

Rate Limiting

Prevent abuse with rate limits:

Setting	Recommended Value	Description
Emails per address	3 per hour	Prevent spam to same address
Emails per IP	10 per hour	Prevent bulk registrations
Failed attempts	5 per 15 min	Lock after failed verifications
Cooldown period	15 minutes	Wait time after lockout

Allow users to authenticate with their existing social accounts.

Supported Platforms:

Google
Facebook
LinkedIn
Twitter/X
Apple

Each provider returns different user data:

Provider	Data Available	Notes
Google	Email, Name, Profile Picture, Locale	Most reliable email verification
Facebook	Email, Name, Profile Picture, Age Range	Email may require additional permission
LinkedIn	Email, Name, Profile Picture, Company, Position	Best for B2B/professional venues
Twitter/X	Username, Name, Profile Picture	Email requires elevated access
Apple	Email, Name	Users can hide real email (relay address)

Data Mapping Configuration:

Map social provider data to IronWifi user fields:

Google:
  email         → username
  given_name    → first_name
  family_name   → last_name
  picture       → avatar_url
  locale        → language

LinkedIn:
  emailAddress  → username
  firstName     → first_name
  lastName      → last_name
  profilePicture → avatar_url
  positions     → company (latest)

Setup Requirements:

Create an OAuth app on the platform
Configure redirect URIs
Enter Client ID and Secret in IronWifi

Detailed Setup Guides:

Go to Google Cloud Console
Create a new project or select existing
Navigate to APIs & Services > Credentials
Click Create Credentials > OAuth client ID
Select Web application
Add authorized redirect URI: https://splash.ironwifi.com/api/signin/google/callback
Copy Client ID and Client Secret
In IronWifi, add Google provider with these credentials

Walled Garden entries:

accounts.google.com
*.googleapis.com
*.gstatic.com

Go to Facebook Developers
Click My Apps > Create App
Select Consumer or Business type
Add Facebook Login product
Navigate to Settings > Basic
Copy App ID and App Secret
In Facebook Login > Settings, add redirect URI: https://splash.ironwifi.com/api/signin/facebook/callback
In IronWifi, add Facebook provider with credentials

Walled Garden entries:

facebook.com
*.facebook.com
*.fbcdn.net
connect.facebook.net

Go to LinkedIn Developers
Click Create App
Fill in app details and verify your company page
Navigate to Auth tab
Add redirect URL: https://splash.ironwifi.com/api/signin/linkedin/callback
Copy Client ID and Client Secret
Under Products, request access to Sign In with LinkedIn
In IronWifi, add LinkedIn provider with credentials

Walled Garden entries:

linkedin.com
*.linkedin.com
*.licdn.com

Go to Apple Developer
Navigate to Certificates, Identifiers & Profiles
Create an App ID with Sign In with Apple capability
Create a Services ID for web authentication
Configure the Services ID with your domain and redirect URL
Create a Key for Sign In with Apple
Download the key file (.p8)
In IronWifi, configure with Team ID, Key ID, Services ID, and key file

Walled Garden entries:

appleid.apple.com
*.apple.com
*.icloud.com

Go to Twitter Developer Portal
Create a new project and app
Navigate to Keys and tokens
Generate OAuth 2.0 Client ID and Client Secret
In app settings, add callback URL: https://splash.ironwifi.com/api/signin/twitter/callback
Enable OAuth 2.0 with appropriate scopes
In IronWifi, add Twitter provider with credentials

Walled Garden entries:

twitter.com
*.twitter.com
*.twimg.com
x.com
*.x.com

SMS Verification

Users receive a verification code via text message.

Requirements:

SMS gateway integration (Twilio, Clickatell, etc.)
SMS credits/account balance

Twilio Setup

Create account at Twilio
Go to Console Dashboard
Note your Account SID and Auth Token
Navigate to Phone Numbers > Buy a Number
Purchase a phone number with SMS capability
In IronWifi:
- Select Twilio as SMS provider
- Enter Account SID
- Enter Auth Token
- Enter From Number (your Twilio number, format: +1234567890)
Configure message template (use {{code}} for verification code)
Set code expiration time (recommended: 5-10 minutes)

Example message template:

Your WiFi access code is: {{code}}. Valid for 10 minutes.

Walled Garden entries:

*.twilio.com

Clickatell Setup

Create account at Clickatell
Navigate to SMS > Create Integration
Select REST API
Copy your API Key
In IronWifi:
- Select Clickatell as SMS provider
- Enter API Key
- Configure sender ID (if applicable)
Set message template and expiration

Walled Garden entries:

*.clickatell.com

Configuration options:

Code length: 4-8 digits (default: 6)
Code expiration: 1-30 minutes
Retry limit: Maximum verification attempts
Phone number format: International format recommended

Voucher Codes

Pre-generated access codes for controlled distribution.

Configuration:

Enable voucher authentication
Set voucher validation rules
Configure input field appearance

See also: Vouchers

Username/Password

Traditional authentication against IronWifi user database.

Configuration:

Enable username/password login
Optional: Allow self-registration
Optional: Enable password reset

SAML Single Sign-On

Enterprise authentication via SAML identity providers.

Supported IdPs:

Azure AD (Entra ID)
Okta
Google Workspace
OneLogin
Any SAML 2.0 compliant IdP

SAML URLs (from Captive Portal settings):

ACS URL (Assertion Consumer Service)
Logout URL
Entity ID

Azure AD (Entra ID) Setup

Go to Azure Portal > Azure Active Directory
Navigate to Enterprise Applications > New Application
Click Create your own application
Name it "IronWifi Captive Portal" and select non-gallery application
Go to Single sign-on > Select SAML
In Basic SAML Configuration:
- Identifier (Entity ID): Copy from IronWifi Captive Portal settings
- Reply URL (ACS URL): Copy from IronWifi Captive Portal settings
- Sign on URL: Your splash page URL
In Attributes & Claims, configure:
- emailaddress → user.mail
- givenname → user.givenname
- surname → user.surname
Download Federation Metadata XML
In IronWifi, upload the metadata XML or enter:
- IdP SSO URL: Login URL from Azure
- IdP Certificate: Download from Azure
- IdP Entity ID: Azure AD Identifier

Walled Garden entries:

login.microsoftonline.com
*.microsoft.com
*.azure.com
*.msftauth.net
*.msauth.net
aadcdn.msftauth.net

Okta Setup

Go to Okta Admin Console
Navigate to Applications > Create App Integration
Select SAML 2.0 > Click Next
Configure General Settings:
- App name: IronWifi Captive Portal
- App logo: Optional
Configure SAML Settings:
- Single sign-on URL: ACS URL from IronWifi
- Audience URI (SP Entity ID): Entity ID from IronWifi
- Name ID format: EmailAddress
- Application username: Email
Add Attribute Statements:
- email → user.email
- firstName → user.firstName
- lastName → user.lastName
Click Next > Finish
Go to Sign On tab > View SAML setup instructions
Copy Identity Provider SSO URL and Certificate to IronWifi

Walled Garden entries:

*.okta.com
*.oktacdn.com

Google Workspace Setup

Go to Google Admin Console
Navigate to Apps > Web and mobile apps
Click Add app > Add custom SAML app
Enter app name: "IronWifi Captive Portal"
Copy Google IdP information (SSO URL, Entity ID, Certificate)
Configure Service Provider details:
- ACS URL: From IronWifi Captive Portal settings
- Entity ID: From IronWifi Captive Portal settings
- Name ID format: EMAIL
- Name ID: Basic Information > Primary email
Add attribute mapping:
- email → Primary email
- firstName → First name
- lastName → Last name
Click Finish
Enable the app for your organizational units
In IronWifi, enter Google IdP details

Walled Garden entries:

accounts.google.com
*.googleapis.com
*.gstatic.com

OneLogin Setup

Go to OneLogin Admin
Navigate to Applications > Add App
Search for "SAML Custom Connector" > Select it
Configure:
- Display Name: IronWifi Captive Portal
- Audience (EntityID): Entity ID from IronWifi
- ACS URL: ACS URL from IronWifi
- ACS URL Validator: Same as ACS URL (escaped)
Go to SSO tab, copy:
- SAML 2.0 Endpoint
- X.509 Certificate
Configure attribute mappings in Parameters tab
In IronWifi, enter OneLogin IdP details

Walled Garden entries:

*.onelogin.com

Payment Integration

Require payment for network access.

Supported Gateways:

Stripe
Braintree
PayPal

Stripe Setup

Create account at Stripe
Go to Developers > API keys
Copy Publishable key and Secret key
In IronWifi Captive Portal settings:
- Enable Payment provider
- Select Stripe
- Enter Publishable Key
- Enter Secret Key
Configure webhook (optional but recommended):
- In Stripe: Developers > Webhooks > Add endpoint
- URL: https://splash.ironwifi.com/api/webhooks/stripe
- Events: payment_intent.succeeded, payment_intent.payment_failed

Creating Access Plans:

In IronWifi, go to Access Plans
Click Add Plan
Configure:
- Name: e.g., "1 Hour Access", "Day Pass"
- Duration: Session length
- Price: Amount in your currency
- Bandwidth: Optional speed limits
- Data cap: Optional data limit

Example plans:

Plan	Duration	Price	Bandwidth
Quick Access	1 hour	$2.99	Unlimited
Day Pass	24 hours	$9.99	Unlimited
Week Pass	7 days	$29.99	Unlimited
Premium	24 hours	$14.99	100 Mbps

Walled Garden entries:

*.stripe.com
js.stripe.com
api.stripe.com

Braintree Setup

Create account at Braintree
Go to Settings > API
Note your Merchant ID, Public Key, and Private Key
In IronWifi:
- Enable Payment provider
- Select Braintree
- Enter credentials
- Select environment (Sandbox for testing, Production for live)
Configure accepted payment methods:
- Credit/Debit cards
- PayPal
- Apple Pay
- Google Pay

Walled Garden entries:

*.braintreegateway.com
*.braintree-api.com
*.paypal.com
*.paypalobjects.com

PayPal Setup

Create business account at PayPal
Go to Developer Dashboard
Create an app under REST API apps
Copy Client ID and Secret
In IronWifi:
- Enable Payment provider
- Select PayPal
- Enter Client ID and Secret
- Select environment (Sandbox/Live)

Walled Garden entries:

*.paypal.com
*.paypalobjects.com

Payment Best Practices

Test in sandbox first - Use test credentials before going live
Clear pricing - Display all fees upfront
Provide receipts - Enable email confirmations
Handle failures gracefully - Show clear error messages
Offer multiple plans - Give users options
Consider refund policy - Document in terms of service

Provider Priority

When multiple providers are enabled, you can set the display order:

Drag providers to reorder
First provider appears most prominently
Consider user preferences for your venue

Combining Providers

Common Combinations

Hotel/Hospitality:

Voucher (primary - included in room rate)
Payment (for extended access)

Café/Restaurant:

Email (simple, captures data)
Social login (faster)

Enterprise Guest:

SAML (employees)
Email (visitors)

Events:

Voucher (registered attendees)
SMS (walk-ins)

Custom Authentication

For advanced needs, implement custom authentication:

REST API Provider

Authenticate against your own backend:

POST https://your-api.com/auth
{
  "username": "...",
  "password": "..."
}

Response: Return HTTP 200 for success, 401 for failure.

Walled Garden Requirements

Each provider may require specific domains in your Walled Garden:

Provider	Required Domains
Google	accounts.google.com, googleapis.com
Facebook	facebook.com, fbcdn.net
SMS	Your SMS provider's domains
Payment	Stripe.com, Braintree domains

See Walled Garden Guide for complete lists.

Best Practices

Minimize friction - Fewer steps = higher completion
Match your audience - Business events may prefer LinkedIn, cafés may prefer email
Always have a fallback - Offer at least two options
Test thoroughly - Verify all providers work on different devices
Consider privacy - Be transparent about data collection

Troubleshooting

OAuth Error: Redirect URI Mismatch

The redirect URI in your OAuth app doesn't match IronWifi's expected URI.

Solution: Verify the exact redirect URI from your IronWifi Captive Portal settings and update your OAuth app configuration.

Causes:

Provider not enabled
Missing API credentials
JavaScript errors

Solution: Check browser console for errors, verify credentials are entered correctly.

Causes:

OAuth app not approved/published
Missing required scopes
Account restrictions

Solution: Ensure your OAuth app is in production mode (not development/testing only).

Quick Reference

Walled Garden Cheat Sheet

Copy these entries based on your enabled providers:

# Always required
107.178.250.42/32

# Google Login
accounts.google.com
*.googleapis.com
*.gstatic.com

# Facebook Login
facebook.com
*.facebook.com
*.fbcdn.net
connect.facebook.net

# LinkedIn Login
linkedin.com
*.linkedin.com
*.licdn.com

# Twitter/X Login
twitter.com
*.twitter.com
*.twimg.com
x.com
*.x.com

# Apple Login
appleid.apple.com
*.apple.com
*.icloud.com

# Microsoft/Azure AD (SAML)
login.microsoftonline.com
*.microsoft.com
*.msftauth.net
*.msauth.net

# Okta (SAML)
*.okta.com
*.oktacdn.com

# Twilio (SMS)
*.twilio.com

# Stripe (Payment)
*.stripe.com
js.stripe.com

# Braintree (Payment)
*.braintreegateway.com
*.braintree-api.com

# PayPal
*.paypal.com
*.paypalobjects.com

Setup Checklist

Use this checklist when configuring a new authentication provider:

Quick Start​

Provider Comparison​

Quick Selection Guide​

Available Providers​

Email Authentication​

Email Template Customization​

Email Domain Restrictions​

Rate Limiting​

Social Login​

Data Collected from Social Providers​

Google Login Setup​

Facebook Login Setup​

LinkedIn Login Setup​

Apple Login Setup​

Twitter/X Login Setup​

SMS Verification​

Twilio Setup​

Clickatell Setup​

Voucher Codes​

Username/Password​

SAML Single Sign-On​

Azure AD (Entra ID) Setup​

Okta Setup​

Google Workspace Setup​

OneLogin Setup​

Payment Integration​

Stripe Setup​

Braintree Setup​

PayPal Setup​

Payment Best Practices​

Provider Priority​

Combining Providers​

Common Combinations​

Custom Authentication​

REST API Provider​

Walled Garden Requirements​

Best Practices​

Troubleshooting​

OAuth Error: Redirect URI Mismatch​

Social Login Button Not Appearing​

"Access Denied" After Social Login​

Quick Reference​

Walled Garden Cheat Sheet​

Setup Checklist​

Related Topics​

Quick Start

Provider Comparison

Quick Selection Guide

Available Providers

Email Authentication

Email Template Customization

Email Domain Restrictions

Rate Limiting

Social Login

Data Collected from Social Providers

Google Login Setup

Facebook Login Setup

LinkedIn Login Setup

Apple Login Setup

Twitter/X Login Setup

SMS Verification

Twilio Setup

Clickatell Setup

Voucher Codes

Username/Password

SAML Single Sign-On

Azure AD (Entra ID) Setup

Okta Setup

Google Workspace Setup

OneLogin Setup

Payment Integration

Stripe Setup

Braintree Setup

PayPal Setup

Payment Best Practices

Provider Priority

Combining Providers

Common Combinations

Custom Authentication

REST API Provider

Walled Garden Requirements

Best Practices

Troubleshooting

OAuth Error: Redirect URI Mismatch

Social Login Button Not Appearing

"Access Denied" After Social Login

Quick Reference

Walled Garden Cheat Sheet

Setup Checklist

Related Topics