cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
4479
Views
0
Helpful
4
Replies
Highlighted
Beginner

MAC prompts for proxy credentials

Hi,


We have MAC added in Windows AD domain. When we login with AD account on MAC, WSA keep asking for Proxy Credentials. WSA is configured to get user verified by Windows AD. On windows clients it works perfectly, but on even when logged on with Windows AD credentials, proxy will ask for credentials again and again.

 

Any idea why does WSA do that? AsyncOS 8.6.

 

Thanks,
Sakun

4 REPLIES 4
Highlighted
Cisco Employee

what is the OS version in MAC?

On OS X Yosemite 10.10.2, apple advised there js a fix in NTLM where safari could continually prompt for credentials when accessing a site protected by NTLM

https://support.apple.com/kb/DL1785?locale=en_US

Highlighted

We use MAC OS 10.9.5. When even when we do not open Safari, just log in into MAC, it will ask for credentials. But once we enter credentials it won't ask again.

 

Shouldn't MAC pass login account credentials to proxy? Does transparent re-direction be issue, because i think i am not using explicit proxy settings, but transparent re-direction and in transparent re-direction WSA cannot process user information, is that correct?

 

Highlighted

Transparent redirection CAN process user info.

When you open a browser, and WCCP redirects you to the WSA, the WSA inserts a credential challenge.

When you set up the WSA for transparent authentication, you join it to the Windows domain, and create a NetBIOS name and add that to DNS.  The challenge appears to come from an internal server, so IE (and now Chrome and Firefox) will use your Windows auth info to answer the challenge and you get access to the internet...

 

On a Mac, since its only sort of joined to the domain, and Safari doesn't grab the windows authentication, you get prompted.

 

I haven't tested this with a Mac in mind, but you may try deploying a CDA.  The CDA grabs authed users from the domain, and passes their IP and auth info to the WSA (and ASA if you want).  We use it because some apps (Outlook, Bentley licensing for engineering apps, others...) don't handle the authentication when they access the internet (eg "show me the pictures" in an email).

 

Highlighted

Thanks, i will give a try with that.

This widget could not be displayed.