Portal authentication is the appropriate method for this scenario. It redirects users on unidentified devices, such as Android BYOD, to a captive portal web page. This portal can be configured with a self-registration option, allowing users to create their own accounts and credentials to gain network access. This is ideal for guest or BYOD environments where users do not have pre-existing credentials and their devices are not part of a corporate domain, making transparent authentication methods unsuitable.

A. Syslog messaging or SAML IdP: Syslog is a passive identification method based on logs from other devices. SAML is for single sign-on, assuming credentials already exist. Neither allows for self-registration.

C. Kerberos-based authentication: This method is for domain-joined devices and requires pre-existing user credentials within an Active Directory environment, which is not applicable to unidentified BYOD devices.

D. SSOMA: The Single Sign-On Mobility Agent (SSOMA) is software installed on endpoints to provide transparent authentication. It cannot be used on devices that do not have it pre-installed.

1. FortiAuthenticator 6.4 Administration Guide

Page 120

"Portals": "Captive portals are used to authenticate users on a network. When an unauthenticated user attempts to access a protected resource

they are redirected to a portal page to authenticate."

2. FortiAuthenticator 6.4 Administration Guide

Page 151

"Guest portals": "Guest portals allow temporary users to self-register for network access. The guest portal can be configured to require guests to enter their name

email address

phone number

and a sponsor's email address." This directly supports the "register and create their own credentials" requirement.

3. FortiAuthenticator 6.4 Administration Guide

Page 21

"Kerberos authentication": "Kerberos authentication enables transparent authentication for domain-joined clients." This confirms it is not for unidentified

non-domain devices.