How do I authenticate to a wireless provider's "open" network without using a browser?

Question

This sort of a setup seems to be common in shopping malls and airports. In Western Canada Shaw provides such a service and calls it "Shaw Open". I'm pretty sure other locales have similar services from providers such as T-Mobile, etc.

From something such as a cell phone it's not very complicated to do. No authentication is necessary to connect to the wifi hotspot as it is "open" for public access. But my cell phone won't connect to websites or remote services via apps until I use my browser and sign in to a particular webpage provided by the ISP.

My question simply stated is: How do I automate the authentication step from a device that doesn't typically have a traditional browser?

I have, in my particular case, a raspberry Pi configured with software that I want to use at trade shows etc. Theses locations have the same sort of "open" hotspots. The Raspi is meant to be self contained. It just does its business and talks to a website. But this outbound connection is blocked by the ISPs "open" connection because I haven't, nor can I complete the browser part of the process.

Assuming I have credentials to do this on a particular provider's network, how can I automate that part of the process without requiring me to open a terminal session to the Pi? What kind of technology is even used here, that I can search for?

Assuming your Pi has Linux, does it have the `wget` program installed? — David Wilkins, Mar 05 '14 at 17:51
Your question is not really about Linux or Unix, it'd be a better fit on [su]. Also, is there any reason you don't want to install a browser on the pi? You could always used a simple text-based, command line browser like `links2` for example. — terdon, Mar 05 '14 at 18:21
@terdon As long as the Pi is running Linux or some other Unix variant, the question is perfectly on-topic here. Conversely, I don't think the Pi is a computer according to SU's definition (but I'm not sure about that, I've never understood that definition nor see it written down anywhere). — Gilles 'SO- stop being evil', Mar 05 '14 at 23:35
@Gilles yes, it is on topic, I did not vote to close. I was just suggesting it might be a better fit on SU. And yes, pi questions are welcome there. — terdon, Mar 05 '14 at 23:38

score 13 · Answer 1 · answered Mar 05 '14 at 21:49

The key to solving problems such as this is knowing how to ask the question. I searched Google looking for "how to access panera bread wifi" and turned up this gem.

Auto login to open Wifi

This article had several scripts that could be used to facilitate the auto logging in. I've opted to include the example for Panera Bread which leverages Python's Mechanize library.

The solution makes use of NetworkManager's dispatcher.d directory to run scripts any time a particular network interface goes up or down. The article details a script that you'd place in this directory, /etc/NetworkManager/dispatch.d, called 07-autologin_openwifi. Here's that script:

#!/bin/bash
#------------------------------
# By Fahad Alduraibi
# Last update: June 12, 2012
# Version: 1.1
#------------------------------

export LC_ALL=C
LogFile="/var/log/07-WIFI_ACCESS.log"

# The parameters that get passed to the script are:
# $1 = The interface name ( eth0, wlan0 ...etc)
# $2 = Interface status ( "up" or "down" )

# Check if wireless status is up
# I have two wifi cards in my laptop, named "wlan0 and wlan1"
# so I use regular expression "wlan[01]" to match both of them.
if [[ "$1" =~ wlan[01] && $2 == "up" ]]; then

    # Get the network name from "iwconfig" or (can also locate the network based on IP or MAC address if needed)
    ESSID=$(/sbin/iwconfig $1 | grep ESSID | cut -d'"' -f2)

    # Record the date and time for debugging purposes only
    echo "[`date`] ESSID=($ESSID)" >> $LogFile

    # If the wireless name matches then run its python script
    if [[ "$ESSID" == "BCPL-PUBLIC-WIFI" ]]; then
        /usr/bin/python /myscripts/baltimore-county_library_wifi.py 1>> $LogFile 2>&1
    elif [[ "$ESSID" == "PANERA" ]]; then
        /usr/bin/python /myscripts/panera.py 1>> $LogFile 2>&1
    elif [[ "$ESSID" == "Nordstrom_Wi-Fi" ]]; then
        /usr/bin/python /myscripts/nordstrom.py 1>> $LogFile 2>&1
    #elif .... (you can add more open wifi here)

    fi
fi

#if [[ "$1" =~ wlan[01] && $2 == "down" ]]; then
    ##If you want to do somehting when the network is down
#fi

And here's the Panera bread script, panera.py:

#------------------------------
# By Fahad Alduraibi
# Last update: June 12, 2012
# Version: 1.1
#------------------------------
import mechanize
import sys

br = mechanize.Browser()
br.set_handle_equiv(True)
#br.set_handle_gzip(True)
br.set_handle_redirect(True)
br.set_handle_referer(True)
br.set_handle_robots(False)
br.set_handle_refresh(mechanize._http.HTTPRefreshProcessor(), max_time=1)
br.addheaders = [('User-agent', 'Mozilla/5.0 (X11; Linux x86_64; rv:13.0) Gecko/20100101 Firefox/13.0')]

testURL = 'http://fadvisor.net/blog/'
response = br.open(testURL)

if response.geturl() == testURL:
  print "FAD: You are already logged in to Panera."
  sys.exit()

try:
  forms = mechanize.ParseResponse(response, backwards_compat=False)
except:
  print "FAD: Error in parsing forms, Am I already logged in to Panera?"
  sys.exit()

response.close

form = forms[0]
#print form
#print "----------------------------------- Login"
request = form.click()
response = mechanize.urlopen(request)
forms = mechanize.ParseResponse(response, backwards_compat=False)
response.close()

form = forms[0]
#print form
#print "----------------------------------- Validate"
#print
request = form.click()
response = mechanize.urlopen(request)
forms = mechanize.ParseResponse(response, backwards_compat=False)
response.close()

form = forms[0]
#print form
#print "----------------------------------- ConfirmLogin New"
#print
request = form.click()
response = mechanize.urlopen(request)
forms = mechanize.ParseResponse(response, backwards_compat=False)
response.close()

form = forms[0]
#print form
#print "----------------------------------- ConfirmLogin Validate"
#print
request = form.click()
response = mechanize.urlopen(request)
forms = mechanize.ParseResponse(response, backwards_compat=False)
response.close()

form = forms[0]
#print form
#print "----------------------------------- CompleteLogin New"
#print

request = form.click()
response = mechanize.urlopen(request)
forms = mechanize.ParseResponse(response, backwards_compat=False)
response.close()

form = forms[0]
#print form
#print "----------------------------------- HttpLoginRequest"
#print

request = form.click()
response = br.open(request)
#print response.read()

response.close()
print "--- Panera Done ---"

I encourage you to read the entire article if you're interested in other methods for doing the auto logging in. The article had several other open WiFi networks that were scripted for the Baltimore, MD area.

This might be the only solution, unfortunately it requires a fair bit of reverse engineering to determine urls and form fields to submit for each different provider which of course has its own challenges not the least of which the developer has to know all possible providers and have first hand access to them; not necessarily possible for my particular scenario. I guess that's about the best I can expect, though. Of course, any one provider's solution could break as soon as they decide to update their web authentication forms. — Octopus, Mar 10 '14 at 20:17

score 1 · Answer 2 · answered Mar 05 '14 at 17:57

1

Depending on how the authentication is implemented, you may be able to send a HTTP request to gain access. This depends on numerous aspects of the particular implementation though.

Keep in mind, these types of authentication are put into place to keep autonomous systems out while allowing only browsers to have access, which is exactly what you are trying to circumvent.

Ideally, you would have a phone you can set up as a wifi hotspot and connect your Pi to that network so you can do whatever you want, but that isn't free.

TL;DR: Beggars can't be choosers

answered Mar 05 '14 at 17:57

David Wilkins

1,030
7
16

1

If it's done via a browser it *must* use HTTP, so this is certainly possible. However, since there's no protocol or standard for this kind of authentication (AFAIK), you'd have to implement something per provider. Which will be useless if you want to take it somewhere you don't have an implementation for. I'd go with the phone hotspot -- it *will* be free if you connect the phone to the open network. – goldilocks Mar 05 '14 at 19:15

score 1 · Answer 3 · answered Jul 01 '15 at 16:37

Apparently these networks with web-based auth rely on MAC based access control post-authentication, so you can simply authenticate on a different device while spoofing your Pi's MAC address, and then your Pi should be able to get on the network.

Got this tip from http://frankiejarrett.com/how-to-connect-apple-tv-to-a-hotel-wi-fi-network/

score 1 · Answer 4 · answered Jun 01 '16 at 19:08

If you have a second network device you can set up NAT forwarding. Connect to your "internal" network with your cellphone or laptop and have the RPi forward that connection to the network at large. Then authenticate with the browser on your laptop or phone. The network sees the external MAC address of your RPi and associates that with the authenticated connection.

I regularly do this with a pocket travel router (old AirPort Express) to connect to hotel internet, then I can connect my Chromecast and other devices to that network without having to re-authenticate.

Even simpler... If your network device is usb and works with a laptop, connect it to a laptop and log into the network. Then reconnect it to the RPi. It should work for several hours.

How do I authenticate to a wireless provider's "open" network without using a browser?

4 Answers4