Portal Configuration
Portal Configuration is the final piece of the Wifi Enterprise puzzle — it binds an Enterprise Designer template and an Enterprise Journey to one or more SSIDs, creating a complete WPA2-Enterprise experience for users. Where captive portal zones link to access points on the network side, Portal Configurations link directly to SSID names, making it easy to serve different enrolment experiences from the same Kiwire installation.
'alt' => 'Dashboard overview', 'caption' => 'The default Kiwire dashboard layout', 'screenshot' => true, 'class' => '', ]) Drop images into: public/assets/img/docs/{page}/{filename} --}}public/assets/img/docs/portal-config/overview.png
How Portal Configuration Works
When a corporate user's device connects to a WPA2-Enterprise SSID for the first time and lacks valid credentials or a client certificate, they are directed to the enterprise enrolment portal. Kiwire resolves which experience to serve by matching the SSID name against the ssid_list of active Portal Configurations. The matching configuration's journey is launched at:
https://your-kiwire-domain/enterprise/{slug}
The user is walked through the journey's enrolment steps (identity verification, certificate generation, profile download) using the configuration's assigned template.
You can also share the enterprise portal URL directly with users — for example, put it in a QR code at the helpdesk or include it in an onboarding email. Users can visit it any time to re-enrol or download a replacement certificate.
Configuration Fields
| Field | Description |
|---|---|
name | Display name for this configuration — shown in the grid and used for admin identification (e.g., Employee SSID Config, Guest Enterprise) |
slug | URL path segment for the enterprise portal. Must be URL-safe (lowercase letters, numbers, hyphens). The portal is served at /enterprise/{slug}. Must be unique across all Portal Configurations for this tenant. |
is_active | Enable or disable this configuration. Inactive configurations are not matched against connecting SSIDs and their portal URL returns a 404. |
template_id | The Enterprise Designer template rendered during the enrolment flow. Only Published templates appear in the picker. |
journey_id | The Enterprise Journey that defines the authentication method and certificate issuance settings for this configuration. |
ssid_list | A list of SSID names (stored as a JSON array) that this configuration handles. When a user on one of these SSIDs needs to enrol, they are directed to this configuration's portal. |
description | Optional admin notes — useful for documenting which department or device type this configuration targets. |
sort_order | Display order in the Portal Configuration grid. Lower numbers appear first. |
The Slug and Portal URL
The slug field determines the public URL at which the enterprise enrolment portal is accessible. For a slug of employee-wifi, the portal is at:
https://your-kiwire-domain/enterprise/employee-wifi
Choose descriptive slugs that match the SSID or department (e.g., staff, contractors, lab-devices). The slug is visible in the browser address bar during enrolment, so a professional, readable slug improves user confidence.
The slug cannot be changed after the configuration is created — the URL may have been distributed to users or embedded in QR codes. If you need to change the slug, create a new configuration and deactivate the old one.
SSID List
The ssid_list field accepts one or more SSID names. Enter each SSID name exactly as it is broadcast by your access points — the match is case-sensitive. When configuring multiple SSIDs in one Portal Configuration:
- All listed SSIDs will route unenrolled users to the same enrolment portal URL
- All users across the listed SSIDs will follow the same journey (same login method and certificate settings)
- A single SSID should appear in at most one active Portal Configuration to avoid ambiguous routing
If the same SSID name appears in two active Portal Configurations, Kiwire matches the configuration with the lower sort_order value. To avoid unintended behaviour, ensure each SSID appears in only one active configuration.
Multiple Configurations — Different Experiences per SSID
One of the main strengths of Portal Configuration is the ability to deliver different enrolment experiences to different SSIDs, even if those SSIDs are served by the same physical access points. Common patterns:
| Scenario | Portal Configuration setup |
|---|---|
Employees on Corp-WiFi, contractors on Contractor-WiFi | Two configurations: Employee config (AD login, 365-day cert, staff template) and Contractor config (Google login, 90-day cert, simplified template) |
| Same SSID, different enrolment UX per building | One SSID in one configuration — use a single template that works for all buildings, or create per-building SSIDs |
| Guest enterprise (conference rooms, partner access) | Separate configuration with registered-account login, shorter cert expiry, and a branded guest template |
Lab / IoT devices on Lab-Enterprise | Dedicated configuration with a simplified template (no Google/AD UI) pointing to a registered-account journey with long cert validity |
Available Actions
| Action | Description |
|---|---|
| Create | Add a new Portal Configuration. Requires a unique slug, a published template, an active journey, and at least one SSID. |
| Edit | Update any field except the slug. Changes take effect immediately for new visitors. |
| Toggle Active | Enable or disable the configuration inline from the grid without opening the edit form. |
| Delete | Permanently remove the configuration. The portal URL ceases to exist. Any users who visit the old URL will receive a 404. |
Required Permissions
view-enterprise-configs · create-enterprise-configs · edit-enterprise-configs · delete-enterprise-configs