Buy or Renew
Buy or Renew
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
4167
Views
10
Helpful
4
Replies

WSA transparent user authentication SSO

reynaldolopeza
Level 1
Level 1

‎10-04-2018 08:39 AM

Hi I have the next question.

 

We have implemented Two WSAs in HA and WCCP transparent mode and configured the rules with IP addresses, now we want to filter rules using AD users, and groups. I've read that in order to authenticate users transparently and without any prompts in the explorers we need to use TUI and a CDA agent.

I want to know if we need to configure every users' browser manually in order to have SSO and no prompts for users, if that it's true it would mean a huge workload for us.

And in this case, what Authentication scheme (Kerberos, NTLMSSP) is the recommended for HTTP and HTTPS traffic?

 

Please your help with this issue.

Labels:
0 Helpful
4 Replies 4

Ken Stieers
VIP
VIP

‎10-04-2018 08:50 AM

If you use CDA (with Windows AD 2012 and older, 2016 and newer aren't supported), you don't have to configure browsers, as CDA scrapes the AD boxes for sign-on events and forwards userid and IP to the WSA



Even if you didn't use CDA, investigate Group Policies to configure the browsers (IE/EDGE/Chrome) to auth to the WSA transparently.

Even with GPO in place, some apps don't support web auth, so they'll fail if they try to hit the internet before the user opens a browser. CDA fixes that too.




reynaldolopeza
Level 1
Level 1
In response to Ken Stieers

‎10-04-2018 09:32 AM - edited ‎10-04-2018 09:33 AM

Hi Ken, thanks for your quick response.

 

I may have misunderstood the concepts of SSO and transparent authentication. So, what you say is that I don't have to configure browsers for SSO if I use CDA, but I do need to configure browsers to authenticate users to the WSA transparently? Please, give me more detail about these affirmations.

 

0 Helpful

Ken Stieers
VIP
VIP
In response to reynaldolopeza

‎10-04-2018 10:51 AM

If you deploy CDA, the users are authenticated before they ever hit the web.





If at all possible, you should configure the browsers to transparently auth, just to cover all of the bases/minimize issues your users might see.

If you configure the WSA right its not that big of a deal.

Keep in mind the WSA joins the domain, and the Proxy interface should have a DNS name/entry in your local DNS so it appears like an "intranet" web server...




Customers Also Viewed These Support Documents