HACA Authentication Process

HACA only supports MAC address-prioritized Portal authentication. iMaster NCE-Campus deployed on the cloud acts as an external Portal server and an HACA server to provide authentication and accounting services. A switch acts as a user authentication point to provide the user authentication function together with the HACA server. User authorization information is configured on the HACA server. After a user passes authentication, the HACA server authorizes network access rights to the user. Figure 1 shows the HACA authentication, authorization, and accounting process.

Figure 1 HACA authentication, authorization, and accounting process

An access device sets up a persistent connection and register with the HACA server using HTTP/2.
The client and device set up a pre-connection before authentication.
The client initiates an authentication request using HTTP. The HACA server provides a web page for the client to enter the user name and password for authentication.
The device and HACA server exchange authentication packets.
After the client passes authentication, the HACA server sends an authorization packet to authorize network access rights to the client.
When the client starts to access network resources, the access device sends an accounting-start request packet to the HACA server.
The HACA server sends an accounting response packet to the access device and starts accounting.
(Optional) If real-time accounting is enabled, the access device periodically sends real-time accounting request packets to the HACA server, preventing incorrect accounting results caused by unexpected user disconnection.
(Optional) The HACA server returns real-time accounting response packets and performs real-time accounting.
The client sends a logout request.
The HACA server sends a logout request packet to the access device.
The access device sends a logout response packet to the HACA server.
The access device sends an accounting-stop request packet to the HACA server.
The HACA server sends an accounting-stop response packet to the access device and stops accounting.