To fetch user agent attribute via redirect, it does need to be redirected to PSN, not external server which would need to have web page interaction. However, you could devise this as a one-time pop. For example, when profile not fully known due to missing user agent, you could return redirect with a welcome page. Once user agent learned, that could trigger reprofile and CoA along with new AuthZ policy that does not redirect them. However, you take the chance that the user agent is enough to reprofile endpoint. Typically it will get you the device OS version and for mobile, maybe the actual device type.