Technical Tip: FortiNAC-F integration with Google Cloud OAuth for Captive Portal authentication

1. Configure the Portal on FortiNAC. The Top-Level Domain (TLD) should be '.com' or '.org' otherwise Google will not accept it.

2. Log in to the Google developer console.
3. Create a Project.

4. Select 'API and Services' -> 'OAuth consent screen' and select 'Create OAuth Client'.

5. Now create a new 'Application Type' and from the drop-down list, select 'Web Application'.

• Give it any name.
• For 'Authorized JavaScript origins' enter the FortiNAC URL: 'https://<fortinaclab.halab.com>'
• For 'Authorized redirect URIs' it depends on the FortiNAC configuration:
  

  Standard User Login: https://<fortiNAC_FQDN>/registration/ValidUserLogin.jsp

  Custom Login: https:/ <fortiNAC_FQDN>/registration/CustomLogin.jsp

  Game Console Registration Login: https://<fortiNAC_FQDN>/registration/GameRegister.jsp 

• After completing the configuration a Client ID and Client Secret will be automatically generated. Copy those key and add them to FortiNAC Portal Configuration -> Edit Portal -> Configuration -> Global -> Settings
• For 'Custom Login Type' select Social.
• Enter the Google Client ID and Google Client Secret.

6. If Google API is not enabled, the notification below will be prompted upon authentication. Copy the URL and enter it in the browser to enable Google People API. Go to APIs and services -> API Library enable it and look for Google People API, then enable it.

7. Configure the Server API Keys.
   • Select Create credentials, and then select API key from the menu.
   • Optional: To bind the API key to a service account, select the Authenticate API calls through a service account checkbox and then select Select a service account to select the service account created.
   • Add API key restrictions (Check API Restriction).
   • The IP should be the FortiNAC Public IP NATing the local FortiNAC traffic to external. To get this IP, run the following:

execute enter-shell

dig +short myip.opendns.com @resolver1.opendns.com

Select Create. The API key created dialog displays the string for the newly created key.

8. Configure the FortiNAC Service Connector:
   • Enter the Client ID previously generated.
   • Make sure to enter the Authenticated Domain (example: gmail.com) otherwise the authentication will fail.
   • To get the Project Number go to Cloud overview -> Dashboard.

Google Project number

Fill in the API key previously created in step 7.

FortiNAC Service Connector

9. To Remove 'Person Visiting', uncheck the Address field and create a Role assign it to authenticated users.

10. Testing:

User authenticated