A method for authenticating a client device in a communications network, including: providing to the client device temporary network access credentials associated with the communications network and comprising a temporary username and password; transmitting by the client device the temporary network access credentials to an authentication server apparatus for the communications network by entering the temporary network access credentials at a registration page of the communications network; in response to receipt of the temporary network access credentials by the authentication server apparatus, connecting the client device to a segregated part of the communications network for encrypted communications therewith; transmitting user registration data from the client device to the segregated part of the communications network by said encrypted communications; obtaining network access credentials by the client device from said authentication server apparatus by said encrypted communications; after the obtaining of the network access credentials, displaying on the client device a user interface arranged for receiving a user input command to connect the client device to the communications network; receiving the user input command to connect the client device to the communications network at the client device and in response thereto the authentication server apparatus issuing a Change of Authorisation, CoA, signal to a Wireless Local Area Network, WLAN, controller in communication with the authentication server apparatus to disassociate the client device from the segregated part of the communications network; transmitting the network access credentials (38, 39) by the client device to the authentication server apparatus which is responsive thereto to transmit to the client device an access accept message (39, 40), wherein the transmitting of the network access credentials includes transmitting from the client device a request to reconnect to the communications network from which the client device had been disassociated by said disassociating the client device from the network, and wherein said request to reconnect is made using a same service set identification, SSID, as used to connect the client device to the segregated part of the communications network. providing to the client device temporary network access credentials associated with the communications network and comprising a temporary username and password; transmitting by the client device the temporary network access credentials to an authentication server apparatus for the communications network by entering the temporary network access credentials at a registration page of the communications network; in response to receipt of the temporary network access credentials by the authentication server apparatus, connecting the client device to a segregated part of the communications network for encrypted communications therewith; transmitting user registration data from the client device to the segregated part of the communications network by said encrypted communications; obtaining network access credentials by the client device from said authentication server apparatus by said encrypted communications; after the obtaining of the network access credentials, displaying on the client device a user interface arranged for receiving a user input command to connect the client device to the communications network; receiving the user input command to connect the client device to the communications network at the client device and in response thereto the authentication server apparatus issuing a Change of Authorisation, CoA, signal to a Wireless Local Area Network, WLAN, controller in communication with the authentication server apparatus to disassociate the client device from the segregated part of the communications network; transmitting the network access credentials (38, 39) by the client device to the authentication server apparatus which is responsive thereto to transmit to the client device an access accept message (39, 40), wherein the transmitting of the network access credentials includes transmitting from the client device a request to reconnect to the communications network from which the client device had been disassociated by said disassociating the client device from the network, and wherein said request to reconnect is made using a same service set identification, SSID, as used to connect the client device to the segregated part of the communications network.