Subscribed Services—The service selection feature presents a personalized list of subscribed services for each subscriber. This information is obtained from the subscriber profile.
Device, Locale, and Brand awareness—The awareness features choose the appropriate resources to use in shaping the pages that are returned to the subscriber's browser.
Self-management features—The self-management features available in LDAP mode allow the subscriber to control account information.
Advertisements—The captive portal feature can deliver advertisement content that is directed at subscriber interests identified in the profile (LDAP mode only) or based on currently subscribed services.
Personal options—Some options within a subscriber profile offer further personalization. For example, you can specify a home URL for Internet connections. Another option allows automatic connections to specified services on a per subscriber basis.
SESM passes the credentials to the SSG in a RADIUS protocol format. A RADIUS server performs the verification procedures. In LDAP mode, the RADIUS server is the SESM RDP server. The RADIUS server verifies against attribute values stored in the subscriber profile.
SESM supports the following authentication schemes:.
The sample SESM portal applications display a logon page that prompts for the two values listed above. SESM passes these values to SSG as standard RADIUS protocol attributes.
Subscriber's telephone number—SESM supports authentication against a telephone number by putting the phone number in the RADIUS attribute 31, CALLING_STATION_ID field.
A web developer can customize an SESM web portal to use a logon page that prompts for telephone number in addition to user name and password. A sample 3-key logon page is included in the SESM web developer kit. See the Cisco Subscriber Edge Services Manager Web Developer Guide for more information. SESM passes the telephone number to SSG as standard RADIUS attribute 31, CALLING_STATION_ID. If no value is supplied on the login page, SESM inserts the user name in this field.
The SESM web developer kit does not offer a way to collect an APN or NAS identifier and send it to SSG. SSG includes this support. See the SSG documentation for details.
To implement 3-key authentication:
If SESM is deployed in RADIUS mode, business logic to verify against three keys must exist in the RADIUS server you are using. See the RADIUS server vendor.
If SESM is deployed in LDAP mode, you can configure the RDP Server to perform 3-key authentication using any number and any combination of standard RADIUS attributes.
In an LDAP directory, administrators can enter the APN and NAS identifier attributes as group values. See the Cisco Distributed Administration Tool Guide for more information.
The subscriber can stop the browser or navigate away from the SESM portal pages, and then return to the SESM pages later and not be required to reauthenticate.
The SESM portal application presents a service list from which the subscriber can select one or more services for connection. The connection features are implemented by SSG and controlled by attributes stored in the subscriber or service profiles.
The SESM web portal can present a service authentication page for services that require it. Service authentication can be based on user name and password. For proxy services, an option in the service profile specifies whether the CHAP or PAP protocol is used to authenticate for the service.
A service is marked as an autoconnect service in the subscriber profile. By default, an autoconnect service is hidden from the service list on the service selection page, but another option in the subscriber profile can specify that it be included in the list. In LDAP mode, the SESM portal application can offer the subscriber the means to self-select or change the services that should be automatically connected.
You can see a sample status page in the NWSP application. The sample page shows the following information about all connected services (including automatically connected services) during the current session:
Currently connected services
Services that were connected during the session but are currently not connected
Connection length of time (for both current and previously connected services)
Transmitted and received byte count on a per service basis
An SESM configuration option controls the SESM action when a subscriber is already logged into one service and then selects another service in the group:
SESM can automatically request SSG to disconnect the first service and connect the new service.
SESM can prompt the subscriber to log off the first service. After the subscriber logs off, SESM requests the connection to the other service.
Note SESM waits for the first service to be disconnected before requesting connection to the new service.
If the connection to the new service fails, the subscriber is not connected to either service.
A mutually exclusive service group is defined in a service group profile. For RADIUS mode deployments, see "Configuring RADIUS," for more information. For LDAP mode deployments, see the Cisco Distributed Administration Tool Guide.
To implement this feature, define the bandwidth options for each service as separate and mutually exclusive services within a service group. This restriction is important to prevent subscribers from simultaneously connecting to (and being billed for) the same service over two different bandwidths.
SESM can support a wide range of service types. In general, SESM supports the service types that are supported by the other elements in the network, such as the SSG.
In Cisco IOS Release 12.2(4)B, the SSG supports the following types of service:
The service provider can impose limits on the number of subaccounts in a main account. This feature allows providers to sell accounts of differing sizes. It also prevents pranksters from creating an endless number of subaccounts.
The RBAC model applies to data stored in an LDAP directory using the SPE extensions that are delivered as part of the SESM LDAP mode installation. Administrators use the Cisco Distributed Administration Tool (CDAT) to enter and manage the RBAC data in the directory.
See the Cisco Distributed Administration Tool Guide for more information about RBAC.
The following sections briefly describe the types of TCP redirection and captivation supported by the SSG in Cisco IOS Release 12.2(4)B and SESM Release 3.1(3). For more information about captive portal features, configuration details, and corresponding SSG TCP redirect requirements, see "Deploying a Captive Portal Solution."
The SSG TCP redirect feature redirects unauthenticated packets to the captive portal application. The SESM captive portal solution can redirect the browser to the login page of an SESM web portal. The captive portal solution can also preserve the originally requested service location and redirect again to connect the subscriber to it.
One effect of deploying unauthenticated subscriber redirections is that subscribers do not need to know the URL to the SESM logon page because they are sent there automatically when they start a browser session. Also, after authenticating, they can be redirected to a home page URL or a service address.
Some examples of how an SESM captive portal solution can support service captivations are:
When a subscriber is not authenticated for a service, the captive portal solution can present a service logon page or perform the authentication on behalf of the subscriber.
When the subscriber is not subscribed to a service, the captive portal solution can present a subscription page.
When service connection is refused because of lack of funds, the captive portal solution can present an explanation. See the "Prepaid Services" section for more information.
The SSG port-bundle host key feature also enhances configuration of large SESM deployments. With port-bundle host key, you do not need to map client subnets to SSGs.
Location Awareness Based on Attributes in the HTTP Request
You can customize an SESM portal to derive the location from attributes in the subscriber's original HTTP request. The SESM web development kit includes a location attribute.
An SESM portal can derive the brand of the subscriber and present different retail pages or different elements within a page based on brand. SESM offers several ways to determine brand.
Note Subscriber groups are known as user groups in CDAT and the RADIUS profiles.
An SESM portal can implement differences among branded groups in many ways, including:
Each brand could have different subscriber privileges.
Each brand could have different subscribed and available services.
Each brand could have different looks to the browser pages, such as different colors or different menu options.
The sample data installed with SESM defines three subscriber groups for branding purposes: bronze, silver, and gold groups. The sample data also defines one user for each of these groups: bronzeuser, silveruser, and golduser. To illustrate branding possibilities, PDA uses a different look and different colors for each brand. NWSP uses different menu options.
An SESM web portal can use conventional Java techniques for internationalization and localization.
SESM includes additional development components that improve upon the standard Java locale-related classes and help reduce the complexity of localizing an SESM web application. Some localization subjects addressed by the SESM components are: time zone, language, and preferred formats for currency, numbers, dates, and times.
Resource bundles contain locale-specific data that varies depending on the user's language and region, such as translatable text for status and error messages and for labels on GUI elements. The developer can add additional resource bundles to a web application to accommodate new locales.
The subscriber's preferred language setting in the browser sets the locale.
Information about the access device, browser type, and the connection location is available from the header.
The portal developer can use one or all of these attributes in the user shape to determine the look and feel of the JSP returned to the subscriber's browser. For example:
If the subscriber's browser language is French and the receiving device is a desktop PC, the response can be rendered in French using HTML.
If another subscriber's browser language is Spanish and the receiving device is a WAP cell phone, the response can be rendered in Spanish using Wireless Markup Language (WML).
Dreamweaver templates can be very useful for customizing or maintaining a web application's JSP pages when many pages have the same layout. By modifying a template and then updating the JSP pages that use the template, you can change the look and feel of an entire set of pages very quickly.
SSG can be configured to send accounting requests to a RADIUS server. The RADIUS server generates the accounting records. See the "Configuring the RADIUS Accounting Feature" section for a summary of how to configure this solution.
In a prepaid services business model, service connection is denied (unauthorized) if there are no funds in the subscriber's account. The SSG Prepaid feature allows SSG to check a subscriber's available credit to determine whether to connect the subscriber to a service and how long the connection can last. The SSG Prepaid feature also supports reauthorizations after connection is granted. If funds are depleted for the account, SSG logs the subscriber off the service.
