Guest access for the public library must not accept staff Active Directory passwords on the captive portal. What should the designer do?
Select an answer to reveal the explanation.
Short Explanation
The guest portal must never become a phishing booth for employee AD passwords. Give guests their own workflow or IdP. Wiring the portal to the same staff LDAP—or replaying PEAP—is exactly the anti-pattern.
Full Explanation
Preventing staff credential reuse on guest portals requires a separate identity provider or guest-specific workflow that does not validate employee AD passwords. Binding the portal to staff LDAP, teaching visitors to use employee usernames, or replaying PEAP credentials onto guest MACs creates credential theft and policy violations. Separation of guest and staff authentication is mandatory.