Subject: [Captive-portals] Onboarding devices and Captive Portal API

From: "M. Ranganathan" <[email-masked]>
Date: Fri, 31 Jan 2020 09:15:44 -0500

Hello,

There are scenarios involving device onboarding where Captive Portal
capability seems like a good fit.

Consider a device that has been securely onboarded  onto a network.
The device wants to present a signed credential to the network  (e.g.
it could present its signed MUD URL) that can be evaluated challenged
by the captive portal server.

Following up on a suggestion by Michael Richardson,  can the Captive
Portal API be extended to do this?

For example,

1. Device onboards and presents its certificate, and signed MUD URL to
the captive portal server.
2. Captive portal server verifies the certificate using the
manufacturer certificate.
3. If certificate and signature are valid, then Captive Portal server
removes the device from quarantine and allows it onto the network. It
could optionally challenge the device to authenticate it but
presumably that step has already been done during onboarding.

Another situation where captive portal could be useful is BRSKI. Not
sure if these use cases are too far removed from the intended use of
this specification.

Thanks for reading,

Regards

Ranga

-- 
M. Ranganathan