uOS 1.38-Captive Portal Enhancements and OIDC Integration

Zyxel_Lynn

Advanced Captive Portal and OIDC Integration

The latest update for Zyxel H series firewalls introduces significant enhancements to Captive Portal authentication, focusing on security and user flexibility.

OIDC External Group Support

Administrators can now leverage external group users for OpenID Connect (OIDC) authentication, specifically with Microsoft Entra. By mapping Entra "Object IDs" to external group objects on the firewall, administrators can apply granular access policies based on corporate group memberships. Currently, external group support is specific to the Captive Portal.

Sign in as a Different User

To address issues with browser credential caching in public or shared environments, a new "Sign in as a different user" option has been added. This allows users to bypass cached single sign-on credentials and manually enter different account details.

Wall Garden Redesign and Cloud Updates

The Trusted Identity Provider (Wall Garden) configuration has been redesigned for clarity, replacing long lists with simple object entries for Google and Microsoft. To ensure reliability, the firewall now queries a Zyxel cloud database every 7 days (and after reboots) to automatically update the necessary FQDNs for these providers.

Interface Security

Captive Portal is no longer supported on "general type" interfaces. Zyxel recommends using remote access VPNs for traffic originating from external interfaces to maintain a higher security posture.