WSA blocking smartphones before authentication

[andre.ortega]

Hello there,
we are deploying WSA and it's working, but when someone access the wifi using an smartphone, and try to access the internet, the access is blocked.

The user connects to the WiFi, then the smartphone detects that doesnt have internet access (because the user arent authenticated on WSA yet) and open its pseudo browser (kind of a popup), warning the user that he should authenticate.
But when the user clicks on that warning WSA send the block page "access not authenticated", instead of ask for authentication.

How we could correct this behavior?

Thanks.

[balaji.bandi]

how is this user authenticated  from smart phone ?

WSA configured of single sign on capabilities ?

Look at the access log, it will give you some idea, why this is failing.

go to command level

grep 

option 1

[andre.ortega]

If user opens a browser, like Chrome, it (the browser) shows a popup then user can authenticate.

The problem is when the smartphone shows automaticaly that "pseudo browser", you know? It is an warning on the top of the phone's screen. In this case, if the user clicks, it shows wsa's block page.

That is the problem. It should shows the popup so user can log in, or at least, it should say "open a browser".

Single sign on doesn't apply to users that are not logged in domain...
There was nothing on access log that could help.

[balaji.bandi]

Coming back to basic information to understand the setup.

it would be nice to explain your setup to understand better.

how is WSA allow user to access internet, what basis ? any user can use your WSA and browse internet, how are you redirecting traffic to WSA, WCCP or proxy config ?

If no log shown means it by passing proxy, what kind of rules setup for these kind of devices.

[andre.ortega]

We are redirecting all traffic (http and https) through PBR.

All users from AD are allowed. There is logs, but it just says "blocked non authenticated access".

I don't know if I made myself clear... but it works if user open a browser on the smartphone and try to access some webpage. In this case the browser shows a popup and then user can log in.
The problem is when the user try to log in using that "fake browser", built in the SO.

Thanks for your help balaji.

[andre.ortega]

20180831_174537.mp4

Video Player is loading.

Play Video

Play

Mute

Current Time 0:00

/

Duration 0:00

Loaded: 0%

0:00

Stream Type LIVE

Seek to live, currently behind liveLIVE

Remaining Time -0:00

1x

Playback Rate

Chapters

• Chapters

Descriptions

• descriptions off, selected

Captions

• captions settings, opens captions settings dialog
• captions off, selected

Audio Track

Picture-in-PictureFullscreen

This is a modal window.

Beginning of dialog window. Escape will cancel and close the window.

Text

ColorWhiteBlackRedGreenBlueYellowMagentaCyanTransparencyOpaqueSemi-Transparent

Background

ColorBlackWhiteRedGreenBlueYellowMagentaCyanTransparencyOpaqueSemi-TransparentTransparent

Window

ColorBlackWhiteRedGreenBlueYellowMagentaCyanTransparencyTransparentSemi-TransparentOpaque

Font Size

50%75%100%125%150%175%200%300%400%

Text Edge Style

NoneRaisedDepressedUniformDropshadow

Font Family

Proportional Sans-SerifMonospace Sans-SerifProportional SerifMonospace SerifCasualScriptSmall Caps

Reset restore all settings to the default valuesDone

Close Modal Dialog

End of dialog window.

Close Modal Dialog

This is a modal window. This modal can be closed by pressing the Escape key or activating the close button.

See the behavior.

[balaji.bandi]

As per the video since it is not English not able to understand.

what is the IP  : 10.91.16.117

is that your proxy URL : http://proxy.insper.local ?

[andre.ortega]

I changed the video, if you can, please edit your post to represent the right content.

Basicaly the IP 10.123.45.102 (new video) is the client IP.

wsa.lab.added.com.br is the WSA hostname.

[Sakun Sharma · Accepted solution]

I believe is not all the application and OS level service supports authentication and would need direct Internet access or transparent redirection with no authentication. Or there is an app called Microsoft Authenticator, maybe try that, that might help.

[Handy Putra · Accepted solution]

I would agree with Sakun here, since displaying the pop up to enter authentication is depends on the application capabilities. Not all application have the capabilities to do this (internet browser such as chrome, firefox, safari, IE can definitely do this).

When you check in the WSA accesslogs, you should find logs that would have TCP_DENIED/407 or TCP_DENIED/401 for that traffic, which indicating WSA is requesting for authentication to move forward and when WSA does not get response on that request, it will display the block page advising authentication required.