The secret is sending an HTML response to the iOS client with a BODY element that contains only the word "Success". The iOS CNA expects something like http://www.apple.com/library/test/success.html to be returned.
For example:
Success
Success
You can redirect the iOS CNA window using javascript:
<script type="text/javascript">
window.location.href = "yourdomain.com/welcome.html";
</script>
Additionally, you can hide the "Success" message by changing the body text to white with a STYLE attribute on the BODY tag. The iOS CNA application doesn't seem to be looking for a page that exactly conforms to Apple's success.html. It seems to be looking for a BODY element that contains the word "Success".
My use case
The captive portal I am using requires that the user agree to the terms of service. The mobile device will detect the captive portal with their CNA (Captive Network Assistant) and open the OS-level browser window with the captive portal login page.
When the user clicks on "Agree & Connect" a form is POSTed which performs the authorization of their MAC on the captive portal appliance.
The webserver returns my own success.html with the white text and the javascript redirect to either the URL requested by the user (for those cases where the user is manually browsing to a website using their mobile browser) or the branded welcome page.
TL;DR:
User connects to the captive portal
Mobile device detects the captive portal
Mobile CNA loads the captive portal login page
User clicks "Agree & Connect", issuing a POST request to my webserver which performs authentication
HTTP 302 redirect is returned from the POST URL pointing to a success.html on my webserver which contains a javscript redirect after the BODY element This triggers the iOS CNA web view to detect that it has successfully connected to the network
CNA login window is redirected to my branded welcome.html
CNA webview window automatically closes in Android or the user can click "Done" on the iOS CNA webview window to close it