Machine name VS username with SSO authentication

[fermendo]

Hi all,

I have an S370 configured for SSO. It works fine most of the times, but at some point, machines (Vista or W7) send the machine name instead of the username. The machine name is valid in AD, so it is authenticated, but since the machine name is not in any valid group, users have no access.

So far I have seen that this happens mostly when the request is not sent by a browser, ie windows update, antivirus update or others. A workaround is to create an identity excluding some user-agents from authentication, but this doesn't seem to solve the problem since there are a lot of exceptions. Another workaround is to lower the surrogate timeout so authentication is asked almost on every request, but this causes performance issues.

Two questions:

-- Is there a known problem or incompatibility between IronPort 7.1.0 and AD on Windows 2008?

-- I'm thinking on changing the surrogate type to cookie instead of IP address. Do you think this will help?

Thanks a lot!!

[edadios]

Hello Fernando,

It may be to do with Network Connectivity Status Indicator feature.

http://tinyurl.com/4q89otg

I see win2008 also has it.

http://technet.microsoft.com/en-us/library/ee126135%28WS.10%29.aspx

I hope this information helps you.

Regards,

Eric

[fermendo]

Hello Eric,

Thanks a lot for your response.

I verified the document you sent, however the workaround provided my Microsoft doesn't work fine, machines send the machine name instead of user even after chaning the windows registry. Anyway that is something to solve with Microsoft.

Let me ask another question, when the surrogate type is set to cookie, will every browser tab ask for authentication? Or how does it work?

Thanks and regards,

Fernando

[edadios · Accepted solution]

Hello Fernando,

As long as the original browser is open, new tabs, and new window for the same browser should not prompt for Auth.

Once you close all instances of the same browser,  or open a new browser, you will be prompted for auth.

Regards,

Eric

[fermendo]

Thanks a lot for your answer Eric!