Found this thread as I'm in the exact same situation (rolling out GCPW in a very small school with no legacy AD infrastructure, wanted to be able to authenticate users to an on-prem Smoothwall, absolutely not interested in captive portal multi-login nonsense, it should just happen invisibly to the user).
Not holding my breath for Smoothwall to introduce a supported solution any time soon, so considering workarounds. The vast majority of my devices are BYOD, so been using RADIUS accounting to authenticate them for ages already, which made that seem like the most sensible option for these devices too.
The suggestion elsewhere in this thread of generating the accounting requests locally on each client felt a bit messy, didn't really want to have to "trust" the entire LAN to send arbitrary data for anything anyone fancies, so I've knocked up a (relatively) quick and dirty webpage that clients can call and that then generates and sends RADIUS accounting start / stop requests to the Smoothwall. I've then coupled that with an even quicker and dirtier .net Windows exe that can be run in a logon / logoff script, grabs the current username, generates an appropriate HTTP request and sends it.
Not that it's really much of a risk for me here, but there's a bit of protection from users crafting their own requests in the form of including a "secret" encoded string in the request - it's pretty much security by obscurity, but good enough for me in this environment - and keeps everything dead simple by making the only requirement to auth that the client runs "logon.exe" at login - very little complexity in that. It also means that we can do some validation / reformatting of the request before sending a RADIUS start, we only have to trust the webserver as a RADIUS client / NAS instead of every client individually and its not possible to start a "fake" session for an arbitrary IP address even if someone did take the whole process apart.
The server-side is all packaged up as a self contained docker container, so it's super-trivial to get it running. If anyone else might find something like this useful, it wouldn't be much effort for me to to tidy it up slightly and share it.
