We'll split it by the crowd, then we'll decide which authentication.
Students, teachers, temporary visitors, cameras, and door-blocking of dumb terminals vary widely. Wrong choice is either not enough security or too poor experience, with daily complaints. NATSHEL_BRANDV7 NATSHEL_AUTH_BILLING supports more than a dozen types of authentications that cover account codes, text messages, microletters, APPs, MAC insensitive, 802.1X, PPPoE, LDAP, third party data sources, etc. The key is not how many batches are made but rather how many people and scenes are combined to make the tightness and convenience.
Several entrances are common to WIFI on campus.
The most used public wirelesss are micro-credit certification, SMS certification or a code for the school account. Micro-certification is best experienced, with students swipe it without passwords; SMS certification is real and traceable and is an essential entry point to meet public security audit requirements. The account code is compatible with the unified school identity system, which makes mandatory first entries and changes in confidentiality to accommodate teaching and a cartoon.
MAC NATSHEL_SEAMLESS_AUTH_AUTH is suitable for fixed terminals. After the first certification of a student's mobile phone, the system remembers MAC and automatically releases it during its validity period, changing classrooms and replacing APs without repeating login. Note that it is not time-limited, too long and dangerous to be safe, and too short to return to re-entry, which is set on a scenario basis. Hostel areas with fixed terminals can also bind accounts and MAC against sharing, but public hot spots are not uninformed because they are too mobile.
802.1X, Portal, PPOPE, each one of them.
802.1X is an end-level authentication, usually tied to a wired office area or scientific area, and can be used on wireless side with the highest security level but experienced and deployed in a highly sensitive way for areas where safety requirements are strictly required. Portal is a web jump certification that best suits public wirelesss and visitors, and pushes what pages can be combined with time, location, user, SSID strategies such as teaching notice at school hours, visitor page pings. PPOE is more present in secondary certifications with operators, using operator account dialling and certification systems to make legal judgements about retransfer operators AAA. The three are not mutually exclusive, and one campus often coexists simultaneously, with the key being sub-regional segmentation.
Why can't we get a text-letter authentication on the real name and trace?
The public areas of the campus, visitors' access to the Internet, and any scene that needs to be traced back, SMS certification is a bottom line. It uses a mobile phone number as a real name carrier, the authentication code passes through it. Public security auditing requires that a true identity and an Internet trail be located. SMS certification provides the first link to this chain.
Connect to the U.S.I. System, with one less account number
Schools usually have a teaching system, a cartoon or LDAP domain. The certification system supports third-party data source authentication, using the school number and work number as a single Internet account without students registering another set. The premise for matching is open port, field mapping, which is a capability that requires on-site confirmation before commitment can be made, and no system can be connected by chests. Fields are not compatible, interfaces are closed, customized development takes place, costs and cycles are assessed separately.
The order of the selection
The order of judgement is simple: first, whether the caller is a fixed user, whether he or she needs a strong name and how high security level; then, if there are AC, BRAS, unified identity systems, behaviour management on the Internet; and finally, if you want to run a billing, sub-region, and package. On campus WIFI, priority is given to micro-mails with a code code for account plus a combination of a code for account, priority 802.1 x plus LDAAP in an office science area, priority is given to text messages from visitors, priority is given to dumb terminal priority is unconscious or special accounts.
Security and experience balance is not optional.
The fact is that the public areas are treated in different ways, with micro-mails to secure their experiences and real names, office science 802.1X to protect their safety, visitors to keep them on a note, fixed end-use non-conscious devices to ensure ease. The highest level of security is used with double factors plus 802.1 X to fit the financial government core, and campuses generally go to medium or high safety. Breaking people apart, they can get access to both.
Decision-making on the combination of accreditation modalities
Small projects have a single, average security requirement and are simple; large- and medium-sized project users are diverse, demanding and mixed; large project users are complex, demanding, graded, and have different entry levels. Decisions are made first on what the site is, and then on which level of safety is lower or upper, and final experience is preferred to safety.
Misappropriation: We believe that the message is not real, we think it's not safe to feel.
Two common error areas are clear. One is that micro-credit authentication is not real, but that it can be verified in combination with a mobile phone number to satisfy the audit, and whether or not it has been made a real name link. The other is that Natshell_SEAMLES_AUTH is unsafe, which is based on MAC and validity judgement, and is safe for fixed user scenes, where risks are only set for too long. Certification methods are not good themselves, so matching scenes is key.