In solutions that use the Cisco Service Selection Gateway (SSG) to provide service connections, the SESM portal presents a service list from which the subscriber can select one or more services for connection. The connection features are implemented by SSG and controlled by attributes stored in the subscriber or service profiles. This section describes the following features:
The SESM web portal can present a service authentication page for services that require it. Service authentication can be based on user name and password. For proxy services, an option in the service profile specifies whether the CHAP or PAP protocol is used to authenticate for the service. For more information, see Appendix C in the Cisco Subscriber Edge Services Manager Installation and Configuration Guide.
A hidden service is an automatically connected service that does not appear on the SESM service selection page.
A service is marked as an autoconnect service in the subscriber profile. By default, an autoconnect service is also a hidden service. Another entry in the subscriber profile can specify that the autoconnected service be included in the service selection list.
In LDAP mode, the SESM portal can offer the subscriber the means to self-select or change the services that should be automatically connected and hidden.
If the SSG port-bundle host key feature is not enabled, the SSG uses the subscriber IP address to identify a session.
If the port-bundle host key feature is enabled, the SSG uses a unique key to identify each currently logged-on subscriber, regardless of the IP address being used. The port-bundle host key is an optional feature on SSG. When enabled, the feature allows SESM portals to support the following types of subscribers:
Overlapping IP addresses in PPP and bridged environments—SESM can differentiate between various subscribers using the same IP address.
The SSG port-bundle host key feature also enhances configuration of large SESM deployments. When port-bundle host key is enabled, you do not need to map client subnets to SSGs.
The sample status page in NWSP (see Figure 3-5) shows the following information about all connected services (including automatically connected services) during the current session:
Currently connected services
Services that were connected during the session but are currently not connected
Connection length of time (for both current and previously connected services)
Transmitted and received byte count on a per service basis
A configuration option controls the SESM action when a subscriber is already logged into one service and then selects another service in the group:
SESM can automatically request SSG to disconnect the first service and connect the new service.
SESM can prompt the subscriber to log off the first service. After the subscriber logs off, SESM requests the connection to the other service.
Note SESM waits for the first service to be disconnected before requesting connection to the new service. If
the connection to the new service fails, the subscriber is not connected to either service.
A mutually exclusive service group is defined in a service group profile.
To implement service selection by bandwidth, define the bandwidth options for each service as separate and mutually exclusive services within a service group. This restriction is important to prevent subscribers from simultaneously connecting to (and being billed for) the same service over two different bandwidths.
The service provider can impose limits on the number of subaccounts in a main account. This feature allows providers to sell accounts of differing sizes. It also prevents pranksters from creating an endless number of subaccounts.
The SSG TCP redirect feature redirects unauthenticated packets to the SESM captive portal solution.
The SESM captive portal solution:
Redirects the browser to the login page of the SESM portal
Optionally preserves the originally requested URL and performs a second redirection after authentication to the original URL
Some benefits to implementing unauthenticated user captivation are:
Subscribers do not need to know the URL to the SESM logon page because they are sent there automatically when they start a browser session.
In a wireless LAN, the feature allows unauthenticated access to the default LAN network but then requires the subscriber to authenticate before accessing the Internet or other services.
The SESM captive portal solution can redirect a subscriber to a home page URL or a predefined service address immediately after authentication.
Examples of how the SESM captive portal solution can support service captivations are:
When a subscriber is not connected for a service, the captive portal solution can present a service logon page or perform the authentication on behalf of the subscriber.
When the subscriber is not subscribed to a service, the captive portal solution can present a subscription page.
When service connection is refused because of lack of funds in the subscriber account, the captive portal solution can present an explanation. See the "Prepaid Services" section for more information.
The SSG TCP redirect feature redirects all authenticated subscribers to the captive portal application.
The SESM captive portal solution can present any type of message for a specified length of time, after which the browser is redirected again to the originally requested service, to an SESM service selection page, or to an automatically connected service.
Initial logon captivation provides a way for providers to present important messages to their subscribers, including announcements of new services and procedures or identity and branding messages.
The SSG TCP redirect feature handles the interval timing mechanism. For each logged-on subscriber, when the specified interval elapses, SSG redirects the next TCP packet originating from the subscriber to the SESM captive portal application.
The SESM captive portal solution presents the advertisement content.
Some possibilities for advertisement captivation using the SESM solution are:
The captive portal solution can present service-specific advertisements by identifying the service name or service URL that is being requested, and presenting advertisements appropriate to users of the service.
The SESM solution can display advertisements tailored to subscriber characteristics stored in the profile, such as hobbies, age, or gender.
SESM includes these values in RADIUS requests as standard RADIUS protocol attributes. The sample SESM portal applications display a logon page that prompts for the two values listed above.
Some deployments might require more than the standard two keys for authentication. SESM supports any number of authentication keys. The keys can be any combination of any RADIUS attribute.
Use the SESM web developer kit to add the authentication fields to the portal logon page.
The SESM web developer kit does not offer a way to collect an APN or NAS identifier. This function must be performed by the cooperating network element, such as the SSG.
If SESM is deployed in RADIUS mode, logic to authenticate with multiple keys must exist in the RADIUS server you are using. Verify that this logic exists with your RADIUS server vendor.
If SESM is deployed in LDAP mode, you can configure the RDP Server to perform authentication using any number of standard RADIUS attributes.
When provisioning subscriber profiles, administrators can enter the APN and NAS identifier attributes as group values. See the Cisco Distributed Administration Tool Guide for more information.
This feature offers the following advantages to subscribers:
Subscribers can stop the browser or navigate away from the SESM portal pages, and then return to the SESM pages later and not be required to reauthenticate.
SESM portals, RDP, and CDAT can support Unicode Transformation Format Version 8 (UTF-8) character representations. UTF-8 supports the traditional 1-byte character sets and double-byte character sets.
SESM web portals can use conventional Java techniques for internationalization and localization.
SESM includes additional development components that improve upon the standard Java locale-related classes and help reduce the complexity of localizing SESM web applications. Some localization subjects addressed by the SESM components are: time zone, language, and preferred formats for currency, numbers, dates, and times.
Resource bundles contain locale-specific data that varies depending on the user's language and region, such as translatable text for status and error messages and for labels on GUI elements. The developer can add additional resource bundles to a web application to accommodate new locales.
The subscriber's preferred language setting in the browser sets the locale.
The access device, browser type, and the IP address are available from the initial request.
The portal developer can use one or all of these attributes in the user shape to determine the look and feel of the JSP returned to the subscriber's browser. For example:
If the subscriber's browser language is French and the receiving device is a desktop PC, the response can be rendered in French using HTML.
If another subscriber's browser language is Spanish and the receiving device is a WAP cell phone, the response can be rendered in Spanish using Wireless Markup Language (WML).
In the portal MBean configuration file, you can add entries that associate a location or a brand with known configuration attributes, such as:
SSG IP address—This method assumes that all requests to a particular range of SSG IP addresses have the same location or brand.
Client subnet—This method assumes that all requests from a particular range of client addresses have the same location or brand.
After the location or brand is known, the application developer can use the following methods to control and present content in the JSPs based on location:
User shape mechanism—The application can use the location dimension in the user shape. The location dimension can determine resources to use in the returned JSPs.
Arbitrary attributes—SESM offers a way to use the configuration file to associate attribute values to locations. At run time, the SESM portal constructs a reference table holding all of the configured attributes and associated values. These attributes are thus available for use in whatever way the application developer chooses.
The NWSP application illustrates location-based awareness as follows:
It uses location to change the banner used on the NWSP logon page. The location determines the city name that appears in the NWSP logo.
It uses attributes based on location to help determine the initial URL for an Internet service pop-up window.
See the Cisco Subscriber Edge Services Manager Installation and Configuration Guide for more information about how to configure branding based on IP addresses, the example in NWSP, and how to demonstrate it.
Note Subscriber groups are known as user groups in CDAT and the RADIUS profiles.
SESM portals can implement differences among branded groups in many ways, including:
Each brand could have different subscriber privileges.
Each brand could have different subscribed and available services.
Each brand could have a different look and feel to the browser pages, such as different colors or different menu options.
The sample data installed with SESM defines three subscriber groups for branding purposes: bronze, silver, and gold groups. The sample data also defines one user for each of these groups: bronzeuser, silveruser, and golduser. To illustrate branding possibilities, PDA uses a different look and feel and different colors for each brand. NWSP uses different menu options.
The Cisco Distributed Administration Tool (CDAT) is the SESM administration tool. CDAT offers a web-based interface from which service provider administrators can perform the following tasks:
From a web-based GUI interface, administrators can view and change values for most attributes in the configuration files for SESM portals, RDP, SPE, and CDAT. The tool does not permit changes to attributes if the change would disrupt the application. The application port, for example, cannot be changed.
Each SESM application has its own instance of a management console, known as the JMXAgent View. From the CDAT main window, you can access the Agent Views for all of the SESM applications. An application's Agent View lists all of the MBeans in the running application.
View current attribute values for the running application, including many read-only attributes useful for application monitoring.
Apply changes to most Read/Write attributes. Applied changes take immediate effect on the running application.
Store changes in the application's configuration file. Stored changes persist for future restarts of the application.
Undo (revert) changes sequentially from the most recent store to the first store made in the session. The Undo action only affects the running application, even though it undoes the stored changes. To persist an undo, you must store the change.
Access policies for subscribers and CDAT administrators
See the Cisco Distributed Administration Tool Guide for more information about these management features.
For RADIUS mode deployments, use administrative tools provided by the vendor of the RADIUS server you are using to maintain subscriber and service profiles.
The RBAC model applies to data stored in an LDAP directory using the SPE extensions that are delivered as part of the SESM LDAP mode installation. Administrators use the Cisco Distributed Administration Tool (CDAT) to enter and manage the RBAC data in the directory.
In a prepaid services business model, service connection is denied (unauthorized) if there are no funds in the subscriber's account. The SSG Prepaid feature allows SSG to check a subscriber's available credit to determine whether to connect the subscriber to a service and the length of the connection. The SSG Prepaid feature also supports reauthorizations after connection is granted. If funds are depleted for the account, SSG logs the subscriber off the service.
