Fortiauthenticator captive portal with Cisco WLC

The typical captive portal workflow for an end-user with a Cisco WLC goes as follows:

1. End-user browser attempts to go through the Cisco WLC to access a website.
2. (Optional step) Cisco WLC is capable of captive portal bypass for authorized MAC addresses through MAC Authentication Bypass method.  Refer to the Cisco documentation for instructions.
3. Cisco WLC intercepts the request and redirects the browser to the FortiAuthenticator's captive portal. The redirect takes the form of an HTTPS request including parameters containing information unique to this particular authentication session. Here is a Cisco WLC redirect sample:
   https://192.168.30.47/portal/?switch_url=https://192.168.30.1/login.html&ap_mac=08:5b:0e:08:d4:ee&client_mac=60:03:08:8f:5e:b6&wlan=ISE-EAP&redirect_url=https://www.nasa.gov
4. FortiAuthenticator successfully authenticates the end-user.
5. FortiAuthenticator redirects the end-user browser to the Cisco WLC captive portal API specified in the "switch_url" parameter of the original captive portal redirect, e.g. https://192.168.30.1/login.html in the above sample. The API call contains the username, password, and buttonClicked=4 parameters. The redirect_url or redirect parameter is also included if it was specified in the original redirect.
6. Cisco WLC triggers a RADIUS authentication request to the FortiAuthenticator using the username and password from the API request.
7. FortiAuthenticator verifies the credentials from the RADIUS authentication request. If valid, it returns a RADIUS Access-Accept response containing the appropriate RADIUS attributes.
8. Cisco WLC redirects the end-user browser to the original website specified in the redirect_url parameter.
   
   I hope this helps to understand.

Best regards.

Ezequiel Bujedo