topic Re: customize http client authentication page in Firewall and Security Management

customize http client authentication page

nlegastelois — Wed, 18 Mar 2020 13:26:08 GMT

Hello,

We are using FW version 80.10 and we have the HTTP client authentication page that has been customized with logo and background, these image have been configured by using links to another web server due to the page size limitation.

We tried to upgrade our gateway to the 80.30 but after that we dicovered that the checkpoint internal web server was using the feature "content security policy" by adding a setting into the header and the browsers block the image when loading the page.

Do you know if know the page size is still limited and if I can host the image from the checkpoint itself and where ?

Is there a way to change the internal web server setting in order to allow external src of image ? and where are the config file ?

Thanks for your help, I am searching for a while about this.

Nico

Re: customize http client authentication page

PhoneBoy — Wed, 18 Mar 2020 13:44:02 GMT

What precise reason are you still using Client Auth?
We've deprecated this authentication method in R80.x and recommend using Identity Awareness, which does have its own Captive Portal.

Re: customize http client authentication page

nlegastelois — Wed, 18 Mar 2020 14:01:47 GMT

To be honest I don't know as the solution are in place for long time and I am trying to manage it now.

We are accessing to the URL http://fw:900 and we can enter our AD credential then it's linked to a radius with MFA. We are using this authentication for users that are connected to a global VPN and we have some part of our network with rules that need to identify the users.

I found that the deamon is in.ahclientd and the web pages are in $FWDIR/conf/ahclientd.

I don't know if it is really User authentication ?

Is it possible to replace by User awareness and how ?

Thanks

Re: customize http client authentication page

nlegastelois — Thu, 19 Mar 2020 17:11:42 GMT

Hello,

other question if the identity awareness is the solution, is there a way to personalize the web site directly by changing the php code ?

Thanks

Re: customize http client authentication page

PhoneBoy — Thu, 19 Mar 2020 23:43:46 GMT

Identity Awareness is the solution, yes.
You might be able to customize the portal by hacking the underlying code, but I don't think we provide any instructions for that.

Re: customize http client authentication page

nlegastelois — Tue, 16 Mar 2021 13:41:35 GMT

Hi,

Sorry to refresh this topic but I am still looking for a way to customize the captive portal because the default possibilities are not sufficients.

Does someone already customized the portal by modifying the code ? Is that something that will follow the Checkpoit upgrades ?

Thank you for your help.

Nicolas

Re: customize http client authentication page

PhoneBoy — Tue, 16 Mar 2021 15:30:37 GMT

The underlying code is in: /opt/CPUserCheckPortal/htdocs
I think it's safe to say any modifications to this will NOT survive an upgrade or maybe even a JHF.