Integrated Windows Authentication (IWA) support

[msanecki]

Hi,

As we know, Microsoft IWA (Integrated Windows Authentication) enables authentication/authorization using Windows AD to provide SSO experience to users. This is not popular scheme but some customers use it in Microsoft based environments.

First of all - is IWA oficially supported in current Secure Web Appliance software versions? If yes, please help me find IWA configuration documentation/guides, and what are requirements or restrictions for proxy implementation with IWA based use cases?

[Ken Stieers]

Yes, even in the latest version, Windows Authentication is supported.
https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa-15-5/user-guide/swa-userguide-15-5/m-authentication-and-authorization.html#con_1392997
You probably want to do it with Kerberos vs. NTLM v2, but its all there...
The other option, that also solves some issues with any version of auth is Transparent auth, where ISE or ISE-PIC grabs the logins from AD and feeds the WSA via pxGrid, that way the WSA sees the user/ip mapping BEFORE the user can open a browser or other tool that will want to access the internet and can apply the appropriate policy. (ignore the references to CDA, it's no longer supported and only supported up to Server 2012R2)

[wajidhassan]

You can find setup details here. For smoother policy enforcement, consider using ISE with pxGrid for transparent authentication, this lets WSA apply user based policies before the browser even starts.