Mist Orgs NAC Portals API

NAC Portals are for onboard Wireless and Wired client with 802.1XThe NAC Portal is a web-based interface that allows users to authenticate andgain access to the network. It is typically used for guest access or for devicesthat do not have a pre-configured certificate for 802.1X authentication.It can also be used to provision certificates for devices that require them with the Mist Application.### NAC-Based External Guest Portal Authorization / How to implement a External Guest Portal#### ContextIn the guest portal flow, context such as SSID, guest MAC, AP MAC is required to unique identify the guest, if it's already authorized (e.g. roam to another AP), and used to instruct the AP to stop redirecting/blocking the user traffic#### RedirectGuest Device (or CNA in MacOS/iOS term) will be redirected to, e.g. “?ap_mac=5c5b35001234&ssid=Guest&…”| Name | Type | Description | |------|------|-------------| | ap_mac | string | AP's MAC address | | site_id | string | Site ID | | device_mac | string | Device's MAC address (the device that blocks the traffic) | | ssid | string | for wireless | | port_name | string | for wired (e.g. eth0, ge-0/0/13) | | client_mac | string | Client's MAC address | #### AuthorizeOnce the guest has gone through your portal flow, authorize them by redirect the user to```GET https://url_generated_by_portal_authorize_url?jwt=```This can be generated by```pythonimport jwtsecret = "EIfPMOykI3lMlDdNPub2WcbqT6dNOtWwmYHAd6bY" # from portal_authorize_jwt_secret above payload = { # for wireless "ap_mac": "5c5b35001234", "wlan_id": "be22bba7-8e22-e1cf-5185-b880816fe2cf", # only for _wireless_ captive portal "client_mac": "d58f6bb4c9d8", # for wired "device_mac": "5c5b35001234", "port_name": "eth0", # only for _wired_ captive portal" "client_mac": "d58f6bb4c9d8", # common # how long should we authorize this session "minutes": 480, "expires": 1768587994, # alternatively # instead of the original URL the user is trying to go to, redirect the user to this URL "forward": "http://www.mist.com", # for testing: if authorize_only=true and authorization is successful, 200 OK will be returned instead of 302 Redirect the user to the `forward` URL "authorize_only": False}encoded_jwt = jwt.encode(payload, secret, algorithm='HS256')```