Wifi Enterprise

Enterprise Journey

An Enterprise Journey defines the complete user onboarding flow for a WPA2-Enterprise (802.1X) network — the sequence of steps that guides a user from first connecting to a corporate SSID all the way through to a fully authenticated, certificate-provisioned device. Unlike captive portal journeys that are triggered by an HTTP redirect, enterprise journeys handle identity verification and cryptographic credential distribution.

'alt' => 'Dashboard overview', 'caption' => 'The default Kiwire dashboard layout', 'screenshot' => true, 'class' => '', ]) Drop images into: public/assets/img/docs/{page}/{filename} --}}

Image not uploaded yet public/assets/img/docs/enterprise-journey/overview.png

The Enterprise Journey list — name, assigned login method, template, and SSID mappings at a glance.

How an Enterprise Journey Works

When a user's device connects to a WPA2-Enterprise SSID for the first time, it lacks the correct credentials or certificates to authenticate via EAP. The enterprise journey handles the enrolment process through a series of guided steps:

Device Registration — The user opens a browser (or is redirected to the enterprise portal). They are identified by email, domain account, or social identity depending on the configured login method.
Identity Verification — Kiwire verifies the user's identity against the selected login method (Registered Account, Active Directory, Google, or Microsoft Entra). Invalid or unauthorised users are blocked here.
Certificate Generation — Upon successful identity verification, Kiwire generates a client certificate for the user's device, signed by the tenant's Root CA. Certificate validity is controlled by the login method's cert_expiry setting.
Configuration Profile Download — The user downloads a device configuration profile (.mobileconfig for iOS/macOS, .xml for Android/Windows) that pre-configures the WPA2-Enterprise SSID with the correct EAP type, RADIUS server details, and installed certificate.
Connect — The user applies the profile (or manually configures the SSID on supported devices) and connects. The device presents its client certificate to the RADIUS server, which validates it against the tenant CA and grants access.

Push configuration profiles via your MDM solution (Jamf, Intune, Mosyle) for zero-touch enrolment. The enterprise journey is then only needed for BYOD devices or users who are not yet enrolled in MDM.

Journey Configuration

Each enterprise journey has the following configuration fields:

Field	Description
`name`	Display name for this journey (e.g., Employee Onboarding, BYOD Enrolment)
`description`	Optional admin notes about the journey's purpose or target audience
`login_method_id`	The Enterprise Login Method instance used to verify user identity during this journey
`template_id`	The Enterprise Designer template rendered to the user during the enrolment flow
`is_active`	Enable or disable this journey. Inactive journeys are not served to users.
`sort_order`	Display order in the journey list grid

Each journey is linked to exactly one Enterprise Login Method instance. The login method determines how user identity is verified during the journey:

Login Method Type	Best for
Registered Account	Users who already have a Kiwire account (guest → corporate upgrade flows)
Active Directory	On-premise Windows domain environments; users log in with their Windows credentials
Microsoft Entra	Cloud-first organisations using Azure AD / Microsoft 365
Google Login	Google Workspace (G Suite) organisations; restricts access to verified domain accounts

The login method must be fully configured and enabled in the Enterprise Login Method module before it can be selected in a journey. An unconfigured or disabled login method will not appear in the journey's login method picker.

Template Selection

A journey is linked to one Enterprise Designer template. Only Published templates appear in the template picker. The selected template controls the visual appearance of all steps in the enrolment flow. Design your template with the journey steps in mind — include a step indicator element and the appropriate download buttons for your EAP type.

SSID Configuration and Portal Configuration Assignment

Enterprise journeys are not assigned directly to SSIDs. Instead, the assignment chain is:

Enterprise Journey → Portal Configuration → SSID

A Portal Configuration links a journey (and its template) to one or more SSIDs. This design allows the same journey to be reused across multiple Portal Configurations, and also makes it easy to A/B test different templates for the same authentication flow without duplicating the journey setup.

If you have separate SSIDs for employees and contractors that use the same Active Directory login method but different templates (e.g., different logos), create one journey and two Portal Configurations — each with its own template — both pointing to the same journey.

Available Actions

Action	Description
Create	Create a new enterprise journey. Requires selecting a login method and a published template.
Edit	Update the journey's name, description, login method, template, or active status.
Preview	Render the assigned template in a device frame to review the visual flow without going through authentication.
Delete	Permanently remove the journey. Journeys actively referenced by a Portal Configuration cannot be deleted — remove those associations first.

Deleting a journey that is referenced by an active Portal Configuration will block the deletion. Remove the Portal Configuration association first, or reassign the Portal Configuration to a different journey before deleting.

Required Permissions

view-enterprise-journeys · create-enterprise-journeys · update-enterprise-journeys · delete-enterprise-journeys