Enterprise Login Methods

Enterprise Login Methods configure how users authenticate when enrolling for WPA2-Enterprise (802.1X) access. Each method connects Kiwire to an identity provider — from the built-in Kiwire account system to external directories and cloud identity platforms. Multiple instances of each type can be configured, making it possible to support several domains or departments from a single tenant.

'alt' => 'Dashboard overview', 'caption' => 'The default Kiwire dashboard layout', 'screenshot' => true, 'class' => '', ]) Drop images into: public/assets/img/docs/{page}/{filename} --}}

Image not uploaded yet public/assets/img/docs/enterprise-login/overview.png

Available Method Types

Type	Identifier	How it authenticates
Registered Account	registered-account	Verifies the user's existing Kiwire username and password against the tenant's user database. Best for organisations that manage their own user directory within Kiwire.
Google Login	google-login	OAuth2 sign-in via a Google Workspace account. Users are redirected to Google, authenticate, and are returned to the enrolment flow. Domain restriction is enforced via the allowed_email_domain setting.
Microsoft Entra	microsoft-entra	OIDC / OAuth2 sign-in via Azure Active Directory (Microsoft Entra ID). Supports multi-tenant and single-tenant Azure applications. Users authenticate with their Microsoft 365 credentials.
Active Directory	active-directory	Direct LDAP bind against an on-premise Windows Server Active Directory domain controller. Users authenticate with their Windows domain credentials (username + password).

Multi-Instance Support

Each login method type can have multiple configured instances. The method_type column is not unique — instances are distinguished by their name (instance label) and database id. This enables several common scenarios:

• Two Active Directory instances for two separate Windows domains (e.g., corp.example.com and subsidiary.example.com)
• Separate Google Login instances for different Google Workspace domains
• Multiple Microsoft Entra instances pointing to different Azure AD tenants (e.g., main company + acquired company)

Each instance is independently enabled/disabled and can be assigned to a different Enterprise Journey, giving you full control over which authentication method applies to which SSID and user group.

Common Fields (All Types)

The following fields are available on every login method instance regardless of type:

Field	Description
name	Instance label — a human-readable name to distinguish this instance from others of the same type (e.g., Corp AD – HQ, Corp AD – Branch)
is_active	Enable or disable this login method instance. Disabled instances cannot be selected in a journey.
profile_id	The access profile automatically assigned to users who authenticate through this method. Controls bandwidth, session time, and data limits.
account_expiry	How long (in days) a Kiwire user account created via this method remains valid. Set to 0 for no expiry.
cert_expiry	How long (in days) the client certificate issued during enrolment remains valid. After expiry, the user must repeat the enrolment journey to get a new certificate.
allow_create_account	Whether a new Kiwire user account is automatically created on first successful authentication (for methods that federate an external identity).
auto_activate	Whether newly created accounts are immediately activated without admin approval.
allowed_email_domain	Restrict authentication to email addresses from specified domains (comma-separated, e.g., example.com,subsidiary.com). Leave blank to allow any domain.
allow_email	Whitelist of individual email addresses always permitted, regardless of domain restrictions.
blacklist_email	Individual email addresses that are explicitly blocked from authenticating.
blacklist_domain	Entire email domains that are blocked (e.g., block all competitor.com addresses).

Microsoft Entra — Extra Fields

In addition to the common fields, the Microsoft Entra type requires these Azure-specific settings:

Field	Description
azure_tenant_id	Your Azure Active Directory tenant ID (GUID). Found in Azure Portal → Azure Active Directory → Overview → Tenant ID.
client_id	Application (client) ID of the registered Azure AD app. Found in Azure Portal → App registrations → your app → Application (client) ID.
client_secret	Client secret value generated in Azure Portal → App registrations → your app → Certificates & secrets. Stored encrypted in Kiwire.

Active Directory — Extra Fields

The Active Directory type requires connection details for your on-premise domain controller:

Field	Description
domain_controller	IP address or hostname of the domain controller (e.g., 192.168.1.10 or dc01.corp.example.com)
account_suffix	Domain suffix appended to usernames for the LDAP bind (e.g., @corp.example.com). Users enter only their username; the suffix is added automatically.
admin_username	Service account UPN used for the initial LDAP bind to look up user attributes (e.g., svc-kiwire@corp.example.com). This account requires read access to the directory.
admin_password	Service account password. Stored encrypted at rest.
base_dn	The LDAP search base — the point in the directory tree from which Kiwire searches for users (e.g., DC=corp,DC=example,DC=com)
ad_mapping[]	Attribute mapping: specifies which AD attribute maps to each Kiwire user field. See the Attribute Mapping section below.

Active Directory Attribute Mapping

The attribute mapping table tells Kiwire which AD attributes to read and store when a user authenticates. Common mappings:

AD Attribute	Kiwire Field
mail	email_address
displayName	fullname
telephoneNumber	phone_number
department	department (used for zone auto-assignment rules)
employeeID	employee_id
sAMAccountName	username

Certificate Expiry

The cert_expiry field controls how long the client certificate issued during the enterprise journey remains valid. When a certificate expires:

• The user's device will fail EAP-TLS authentication and be disconnected from the enterprise SSID.
• The user must revisit the enterprise portal, re-authenticate via the login method, and download a new certificate and configuration profile.
• The old (expired) certificate record is marked as revoked in the RADIUS certificate store.

Form Structure

The login method configuration form is split into two sections:

• Core fields (always visible) — instance enable toggle and instance name
• Advanced Configuration (collapsible) — all remaining fields organised into subsections: Identity Provider Settings, Account Provisioning, and Email Restrictions

The Advanced Configuration section auto-expands when editing an existing instance that already has data configured.

Required Permissions

view-enterprise-login-method · edit-enterprise-login-method