topic Re: WSA blocking smartphones before authentication in Web Security

WSA blocking smartphones before authentication

andre.ortega — Wed, 29 Aug 2018 15:06:51 GMT

Hello there,
we are deploying WSA and it's working, but when someone access the wifi using an smartphone, and try to access the internet, the access is blocked.

The user connects to the WiFi, then the smartphone detects that doesnt have internet access (because the user arent authenticated on WSA yet) and open its pseudo browser (kind of a popup), warning the user that he should authenticate.
But when the user clicks on that warning WSA send the block page "access not authenticated", instead of ask for authentication.

How we could correct this behavior?

Thanks.

Re: WSA blocking smartphones before authentication

balaji.bandi — Wed, 29 Aug 2018 19:22:03 GMT

how is this user authenticated from smart phone ?

WSA configured of single sign on capabilities ?

Look at the access log, it will give you some idea, why this is failing.

go to command level

grep

option 1

Re: WSA blocking smartphones before authentication

andre.ortega — Wed, 29 Aug 2018 20:01:22 GMT

If user opens a browser, like Chrome, it (the browser) shows a popup then user can authenticate.

The problem is when the smartphone shows automaticaly that "pseudo browser", you know? It is an warning on the top of the phone's screen. In this case, if the user clicks, it shows wsa's block page.

That is the problem. It should shows the popup so user can log in, or at least, it should say "open a browser".

Single sign on doesn't apply to users that are not logged in domain...
There was nothing on access log that could help.

Re: WSA blocking smartphones before authentication

balaji.bandi — Thu, 30 Aug 2018 04:52:13 GMT

Coming back to basic information to understand the setup.

it would be nice to explain your setup to understand better.

how is WSA allow user to access internet, what basis ? any user can use your WSA and browse internet, how are you redirecting traffic to WSA, WCCP or proxy config ?

If no log shown means it by passing proxy, what kind of rules setup for these kind of devices.

Re: WSA blocking smartphones before authentication

andre.ortega — Thu, 30 Aug 2018 12:24:40 GMT

We are redirecting all traffic (http and https) through PBR.

All users from AD are allowed. There is logs, but it just says "blocked non authenticated access".

I don't know if I made myself clear... but it works if user open a browser on the smartphone and try to access some webpage. In this case the browser shows a popup and then user can log in.
The problem is when the user try to log in using that "fake browser", built in the SO.

Thanks for your help balaji.

Re: WSA blocking smartphones before authentication

andre.ortega — Fri, 31 Aug 2018 20:53:03 GMT

(view in My Videos)

See the behavior.

Re: WSA blocking smartphones before authentication

balaji.bandi — Thu, 30 Aug 2018 18:59:11 GMT

As per the video since it is not English not able to understand.

what is the IP : 10.91.16.117

is that your proxy URL : http://proxy.insper.local ?

Re: WSA blocking smartphones before authentication

andre.ortega — Fri, 31 Aug 2018 20:56:16 GMT

I changed the video, if you can, please edit your post to represent the right content.

Basicaly the IP 10.123.45.102 (new video) is the client IP.

wsa.lab.added.com.br is the WSA hostname.

Re: WSA blocking smartphones before authentication

Sakun Sharma — Tue, 04 Sep 2018 06:52:49 GMT

I believe is not all the application and OS level service supports authentication and would need direct Internet access or transparent redirection with no authentication. Or there is an app called Microsoft Authenticator, maybe try that, that might help.

Re: WSA blocking smartphones before authentication

Handy Putra — Wed, 05 Sep 2018 02:51:17 GMT

I would agree with Sakun here, since displaying the pop up to enter authentication is depends on the application capabilities. Not all application have the capabilities to do this (internet browser such as chrome, firefox, safari, IE can definitely do this).

When you check in the WSA accesslogs, you should find logs that would have TCP_DENIED/407 or TCP_DENIED/401 for that traffic, which indicating WSA is requesting for authentication to move forward and when WSA does not get response on that request, it will display the block page advising authentication required.