Kiwire docs

Appearance

Setting up WiFi Enterprise (802.1X) ​

How to give staff (or students, residents, long-stay tenants) a secure WPA2/WPA3-Enterprise network: they sign in once on an onboarding page with the account they already have, install a certificate on each device, and from then on their devices join the secure network by themselves. This page takes you through the whole set-up in the order you do it, then covers removing access when someone leaves and what to check when a device won't connect.

WiFi Enterprise or the captive portal? ​

Both use Kiwire, but they work differently.

Captive portalWiFi Enterprise
The networkOpen (or a shared password), with a login pageWPA2/WPA3-Enterprise, also called 802.1X
When people sign inEvery time their session endsOnce per device, on the onboarding page
What the device holdsNothing, or a remembered MACIts own certificate, or a username and password
Traffic over the airNot encrypted per user on an open networkEncrypted per user
Who it suitsGuests, visitors, customersStaff, students, residents, anyone who comes back every day
MenuPortals › Captive PortalPortals › WiFi Enterprise

Use WiFi Enterprise when the same people connect every day and you want each of them to have their own access that you can switch off on its own — for example the office network, alongside an ordinary captive portal for visitors. Both can run on the same controllers at the same time, on different SSIDs.

How a staff member gets connected ​

This is what the people you invite will do. It helps to know it before you build anything.

  1. Open the onboarding page. You give them a link such as https://<your-kiwire-host>/wifi/staff-portal, or a QR code for it (see Sharing the link). They open it on any working internet connection — mobile data, home broadband or your guest network. They can't use the secure network yet.

  2. Sign in. The page shows the sign-in options you chose: Sign in with Google, Sign in with Microsoft, Continue with SSO, their Active Directory username and password, a code sent by WhatsApp, or an existing Kiwire username and password.

  3. Kiwire finds or creates their account. The first time someone signs in with Google, Microsoft, SAML or WhatsApp, Kiwire creates a WiFi account for them under the profile you chose (so you control their speed and limits). Their next sign-in uses the same account.

  4. They land on their home page. It shows their usage, the network name (SSID) to join and, if you switched it on, a Certificate tab.

  5. They get a certificate for the device. On the Certificate tab they click Add Certificate, type a Device Name (for example My laptop), pick Windows, macOS, Android or iOS, choose a Certificate Password of at least 4 characters, and click Generate. They download the file and follow the Install & Connect steps shown for that device type — on Apple devices it is a profile they install from Settings; Android also shows a QR code to scan from the Wi-Fi settings.

    On Android, the Kiwire WiFi app (free on Google Play; the store link is at the foot of the Kiwire admin sign-in page, so you can pass it on with the invitation) can do this step instead of the browser: the person signs in with Google in the app, through your onboarding page, and the app installs the certificate on the phone. The app's sign-in works with Google Login methods only; people who sign in another way use the steps on the page.

  6. The device joins the secure SSID. From then on it connects by itself, using the certificate. They repeat steps 5–6 for each device — a phone, a laptop and a tablet each get their own certificate.

A certificate is valid for the Certificate Expiry set on the login method the person signed in with — 365 days unless you change it (see step 1). Before it runs out, the person signs in on the onboarding page again and makes a new one. Their certificate list shows each certificate's expiry date, and they can delete the ones they no longer need.

Username and password instead of a certificate ​

The home page also shows Wi-Fi Credentials: the username and a password, with the instruction to choose PEAP as the EAP method and MSCHAPv2 as inner authentication. Pressing Show reveals the password:

  • People who sign in with Registered Account or Active Directory see (use your login password) — they use the password they signed in with.
  • People who sign in with Google, Microsoft, SAML or WhatsApp have no login password of their own, so Kiwire gives their account a random Wi-Fi password and Show displays it. They can type it into a device that can't install a certificate.

Changing that password. People who signed in with a Registered Account also get a Password tab on their home page: they type their Current password and a New password twice and click Save new password. The new password must follow your tenant's password policy, and it becomes both their onboarding sign-in password and their Wi-Fi (PEAP) password, so they re-enter it on any device set up with username and password; certificates are not affected. Active Directory users change their password in the directory, and Google, Microsoft, SAML and WhatsApp users have no sign-in password, so they don't see the tab.

A certificate is still the better choice where the device supports it: each device gets its own, and you can delete one device's certificate without affecting the others.

What you need before you start ​

  • Your controllers connected to Kiwire. Each controller (or access point) that will broadcast the secure SSID needs a Device Controller record in Kiwire with its Identity and shared secret, exactly as for the captive portal. See Connecting a controller and Set up a controller, step by step.
  • The sign-in source set up as a connector, under Grow › Connectors, unless people will use a Kiwire username and password (Registered Account). See Connectors:
  • At least one profile for the people who will enrol — the speed and limits they get. Staff usually get a profile with no time or data allowance, so their devices aren't cut off. See Profiles and bandwidth.
  • The platform certificate. Kiwire's RADIUS server certificate and the root certificate that signs every device certificate are provided by Synchroweb for the whole platform; you don't create them. If the root certificate isn't ready, staff see Root CA not yet generated. Contact your network administrator. instead of the Add Certificate button — contact Synchroweb.

You set WiFi Enterprise up in four places, in this order: Login Methods, Page Designer, Journey, Configuration — all under Portals › WiFi Enterprise.

1. Add a login method ​

A login method is one sign-in option on the onboarding page, tied to a connector and a profile.

  1. Go to Portals › WiFi Enterprise › Login Methods and click Add Login Method.

  2. Pick the type: Registered Account, Google Login, Microsoft Entra ID, Active Directory, WhatsApp OTP or SAML 2.0 SSO. A type you can't see is one your role isn't allowed to set up — each connector-backed type needs the matching connector permission (for example manage-connector-google).

  3. Give it an Instance Name you'll recognise later, such as Head office – Microsoft.

  4. Choose the Connector and the profile under Link with Profile. Everyone who signs in through this method gets that profile.

  5. Under Access Control, decide who may enrol:

    • Allow Create Account — on: anyone who passes the sign-in gets an account the first time. Off: only people who already have an account can sign in.
    • Auto Activate After Register — on: new accounts work at once. Off: new accounts are created as inactive, and the person sees Your account is inactive until you set the account to Active under Account › Users.
    • Account Expiry — how many days a new account lasts (5 years by default).
    • Certificate Expiry (days) — how long each certificate made by people who sign in through this method stays valid. 365 by default.
    • Allowed Email Domains — the most useful setting for Google and Microsoft: enter your own domain (for example company.com) so a personal Gmail or another organisation's Microsoft account can't enrol. Allowed Emails, Blacklist Emails and Blacklist Domains narrow it further.

    These settings apply to Google, Microsoft, SAML and WhatsApp sign-ins. An Active Directory method lets in anyone whose username and password the directory accepts, and their account is active at once; control who may enrol in the directory itself, or with group mapping (below).

  6. Switch the method Active and click Save.

The full field list for every type is in Login methods › Enterprise.

Microsoft: pin it to your organisation. On the Microsoft Entra ID connector, use your organisation's own Directory (tenant) ID rather than common or organizations. Then only accounts from your organisation can sign in, and people from other organisations see Your Microsoft account is not from an organisation this WiFi accepts.

One profile per method, or group mapping. Google and Microsoft give everyone who signs in through one method the same profile. To give different groups different profiles, either add a second method of the same type with its own profile and put both on the page, or use a method type that can map groups:

  • Active Directory — under Advanced Configuration › Group Mapping, click Add Mapping for each group. Enter the group's full name as it appears in the directory (Group Name / DN, for example CN=Staff,DC=company,DC=local), the profile to give, and a Priority. When someone is in several mapped groups, the lowest priority number wins. Someone in none of them gets the method's own profile.
  • SAML 2.0 SSO — under Group Mapping, each row has a Field (from the attributes your SAML connector receives), a Match Value and a profile. When the field's value matches exactly, that profile is used.

The profile is set again each time the person signs in on the onboarding page, so moving someone to another group takes effect at their next sign-in there.

2. Design the onboarding page ​

  1. Go to Portals › WiFi Enterprise › Page Designer and create a template.
  2. From the Page blocks, drag a starter onto the canvas: Login Page (username and password — for Registered Account or Active Directory), Google Login Page (one sign-in button — use it for Google or Microsoft and change the button text), SSO / SAML Login, or the two WhatsApp OTP pages (Phone and Verify).
  3. Select the form on the page, click Form Submit in the top toolbar, choose the login method you created in step 1 and click Apply. A form that isn't linked to a login method does nothing when the button is pressed.
  4. Add your logo and wording, then save and Publish the template. The onboarding page only shows published templates.

Want more than one sign-in option on the page — say Microsoft for staff and a Kiwire account for contractors? Put a form for each on the page and link each to its own login method. The editor itself is covered in Portal designer.

3. Build the journey ​

The journey says which page people see.

  1. Go to Portals › WiFi Enterprise › Journey and create a journey.
  2. Open it. From the Node Palette, drag a Start node, a Portal Page node and an End node onto the canvas.
  3. Click the Portal Page node and choose the template you published. Connect Start to the page, and the page to End. If the page has buttons that lead to another page (for example the WhatsApp Phone page to the Verify page), add a Portal Page node for each and connect them.
  4. Click Publish. A journey still in draft isn't shown to anyone.

After a successful sign-in, people always go to their home page, whatever the journey's last node is.

4. Create the configuration ​

The configuration is the onboarding page's web address. It ties a journey to a link and sets what goes into the device profiles.

  1. Go to Portals › WiFi Enterprise › Configuration and click New Configuration.
  2. Fill in:
    • Active — only active configurations are served.
    • Configuration Name — for example Staff WiFi Portal.
    • URL Slug — lowercase letters, numbers and hyphens, for example staff-portal. The page is then at https://<your-kiwire-host>/wifi/staff-portal. A slug must be unique across the whole platform, so a common word may already be taken.
    • Journey — the journey from step 3.
  3. On the WiFi tab:
    • SSID Note — type your secure network's name on the first line, exactly as the controller broadcasts it (capitals count). The first line is written into every device profile as the network name, so a mismatch means devices never join. Further lines are notes only. If you leave it empty, profiles are made for a network called Enterprise-WiFi.
    • Encryption — WPA2-Enterprise, WPA3-Enterprise or WPA2/WPA3 Transition, matching the SSID on your controller.
    • Profile Display Name and Organization Name — what people see on the installed profile in their device settings, for example Acme Secure WiFi and Acme Sdn Bhd.
    • Enable Certificate Panel — switch this on. It adds the Certificate tab to staff home pages; without it nobody can make a certificate.
    • Remark — your own notes; staff never see them.
  4. The SEO tab sets the browser-tab title, the link preview and the icon. It is optional.
  5. Leave the Passpoint tab switched off unless Synchroweb has set up Passpoint (Hotspot 2.0) with you. Switching it on changes the kind of profile people get.
  6. Click Save.

The top of the page shows how many configurations have the certificate panel on, and a warning when the platform's RADIUS server certificate is close to expiry.

In the configuration list, the share button next to the URL Slug opens Share Portal: Copy URL for an email or intranet post, and Download QR for a poster or the welcome pack. A good invitation tells people to open the link on mobile data or the guest network, sign in with their work account, and use the Certificate tab on each device.

5. Set up the secure SSID on your controller ​

On the controller, create (or change) the staff SSID to use WPA2-Enterprise, WPA3-Enterprise or both, with Kiwire as its RADIUS server:

  • Authentication on UDP port 1812 and accounting on UDP port 1813, at the RADIUS server address shown in your Setup Guide checklist (where to find it).
  • The same shared secret and Identity as the controller's Device Controller record in Kiwire (RADIUS shared secret).
  • Accounting switched on, so sessions and usage appear in Kiwire's reports.
  • No captive portal or splash page on this SSID.

Your vendor's page under Setup guides by vendor shows where these settings are; on UniFi, Kiwire can create the enterprise SSID for you (see Ubiquiti). The same rules apply as for guests: if the controller is switched off in Kiwire, or it is outside its opening hours, enterprise connections are refused too (Switching Wi-Fi off and opening hours).

6. Test it yourself ​

  1. On your phone, using mobile data, open the onboarding link and sign in with your own work account.
  2. On the Certificate tab, make a certificate for the phone, install it and join the secure SSID.
  3. In Kiwire, check Account › WiFi Certificate — your certificate is listed — and Reporting › Login › Active Session, where your phone should appear.

Seeing who has enrolled ​

Account › WiFi Certificate lists every certificate made on your onboarding pages: the Username, the Cert Name (the device name the person typed), when it was Created and when it Expired (or will expire), which device type it was made For Device, the browser it was downloaded From Device, and the Download URL (the configuration it was made on). You can search by username, certificate name or device type. Certificates can't be created here — only on the onboarding page.

Select a certificate and click View for its details and the owner's usage. The certificate password the person chose is never shown to administrators: the panel only says Set by the user (not shown).

Enrolled people are ordinary accounts under Account › Users. Their usage shows in the login reports like any other user's.

Removing access ​

SituationWhat to doEffect
One device is lost, stolen or replacedOn Account › WiFi Certificate, select that device's certificate and click Delete.That certificate and its download files are removed, and it is refused from its next connection. The person's other devices keep working, and they can make a new certificate.
Someone leaves, or must lose access nowUnder Account › Users, Edit their account, set Status to Suspended and save.Any session running now is disconnected, every certificate they hold is refused at the next connection, and they can't sign in on the onboarding page.
Their account has reached its expiry dateNothing.An expired account is refused like a suspended one.

People can also delete their own certificates from their certificate list on the home page.

Leavers removed automatically ​

A device with a certificate keeps connecting on its own; it never signs in to Google, Microsoft or Active Directory again. So deleting someone in Google Workspace, Microsoft 365 or Active Directory does not, by itself, stop their WiFi. Switch on the directory check to close that gap:

  • Once a day, early in the morning (Malaysia time), Kiwire asks your directory about each person who enrolled through that Google, Microsoft, Active Directory or LDAP connector.
  • Someone deleted, suspended or blocked from signing in is suspended in Kiwire and disconnected, so every device they enrolled stops connecting.
  • Someone who comes back in the directory is made active again — but only if the check suspended them. Accounts you suspended yourself are left alone.
  • People who signed in with an address outside your directory (a personal Gmail, a guest from another organisation) are skipped.
  • If one day's check would suspend an unusually large number of people (more than 5, and more than a quarter of everyone checked), nothing is changed. Every admin is notified instead, and the connector page lists who would be suspended with a button to go ahead.

To switch it on, open the connector under Grow › Connectors and scroll to Directory check. Click Preview first: it shows who would be suspended without changing anything. Then turn on Check the directory every day. Run now does a real check straight away.

What it needs from your directory:

  • Google Workspace — the Admin SDK API enabled in the Google Cloud project that holds the connector's OAuth client, and a Workspace admin clicking Connect Google Workspace and allowing Kiwire to see users and see domains (read-only).
  • Microsoft 365 — the Microsoft Graph application permission User.Read.All on the connector's app registration, with admin consent granted, and the connector set to your organisation's own Directory (tenant) ID.
  • Active Directory or LDAP — an account that can read user accounts: the connector's admin user for Active Directory, or a Bind DN and Bind password on an LDAP connector. A person not found counts as removed; a disabled or expired Active Directory account counts as suspended.

The step-by-step instructions and the error messages are in Directory check. For people who sign in with SAML, WhatsApp or a Registered Account there is no daily check: suspend their account in Kiwire when they leave.

Licence limits ​

If your licence has an Enterprise Auth User Limit (shown on System › License), each person who connects to an enterprise SSID counts once per billing month, however many devices they use. When the limit is reached, people who haven't connected yet that month are refused with Enterprise Auth connection limit reached; people who already connected that month carry on. On a subscription plan, Enterprise Auth Overage Settings on the same page let you allow extra users to be billed (Enable Auto-Charge) and cap how many (Maximum Extra Users). See Licence and add-ons.

Who can do what ​

TaskPermission
See and design onboarding templatesview-enterprise-templates, plus create-, edit-, delete- and publish-enterprise-templates
See and build journeysview-enterprise-journey, plus create-, edit- and delete-enterprise-journey
See and change login methodsview-enterprise-login-method, edit-enterprise-login-method — and the connector permission for each connector-backed type
See and change configurationsview-enterprise-configs, plus create-, edit- and delete-enterprise-configs
See and delete certificatesview-wifi-certificates, delete-wifi-certificates
Set up the directory checkThe permission to manage that connector, for example manage-connector-google or manage-connector-microsoft

The full list is in Roles and permissions.

If something goes wrong ​

What you seeLikely cause and fix
The onboarding link shows an error pageThe configuration is switched off, has no journey, or its journey or template isn't published. Check all three.
The button on the page does nothingThe form isn't linked to a login method. In the Page Designer, select the form, click Form Submit, choose the method and publish again.
No Certificate tab on the home pageEnable Certificate Panel is off on that configuration.
Root CA not yet generated. Contact your network administrator.The platform certificate isn't ready. Contact Synchroweb.
Your account is not assigned to any access profile.The login method has no profile under Link with Profile, or (Active Directory) no group matched and there is no default profile.
No account found for this identity.Allow Create Account is off and the person has no account yet. Turn it on, or create the account.
Your account is inactive.Auto Activate After Register is off. Set the account to Active under Account › Users.
The person is refused because of their emailTheir address isn't in Allowed Email Domains or Allowed Emails, or it is blacklisted. Personal accounts are refused when you allow only your domain — that is intended.
Your Microsoft account is not from an organisation this WiFi accepts.They signed in with an account from another Microsoft organisation, and your connector is pinned to your own.
Google or Microsoft sign-in shows redirect_uri_mismatch or AADSTS50011The redirect URI on the Google OAuth client or Azure app registration doesn't match the one shown on the connector. See Connectors.
The certificate installs but the device never joins the networkThe first line of SSID Note doesn't match the SSID's name exactly, or Encryption doesn't match the SSID. Fix the configuration, then have the person make a new certificate.
The device tries to join but is refusedCheck, in order: the controller has a Device Controller record with the right Identity and shared secret; the account is active and not expired; the certificate is still listed on Account › WiFi Certificate and not past its expiry; the controller is switched on and inside its opening hours; the Enterprise Auth user limit isn't reached. Before you leave site has the controller checks.
Someone who left can still connectSuspend their account under Account › Users. If they enrolled through Google, Microsoft, Active Directory or LDAP, switch on the directory check so this happens by itself next time.
A certificate stopped workingIt expired — the expiry date is on Account › WiFi Certificate. The person signs in on the onboarding page again and makes a new one. To give longer-lasting certificates, raise Certificate Expiry on the login method; it applies to certificates made from then on.

Last updated:

Kiwire platform documentation

Synchroweb