Cisco Cisco Web Security Appliance S690 User Guide
5-23
AsyncOS 8.1 for Cisco Web Security User Guide
Chapter 5 Acquire End-User Credentials
Failed Authentication
* Works after the client makes a request to an HTTP site and is authenticated. Before this happens, the
behavior depends on the transaction type:
behavior depends on the transaction type:
•
Native FTP transactions. Transactions bypass authentication.
•
HTTPS transactions. Transactions are dropped. However, you can configure the HTTPS Proxy to
decrypt the first HTTPS request for authentication purposes.
decrypt the first HTTPS request for authentication purposes.
** When cookie-based authentication is used, the Web Proxy cannot authenticate the user for HTTPS,
native FTP, and FTP over HTTP transactions. Due to this limitation, all HTTPS, native FTP, and FTP
over HTTP requests bypass authentication, so authentication is not requested at all.
native FTP, and FTP over HTTP transactions. Due to this limitation, all HTTPS, native FTP, and FTP
over HTTP requests bypass authentication, so authentication is not requested at all.
*** No surrogate is used in this case even though cookie-based surrogate is configured.
Tracking Re-Authenticated Users
With re-authentication, if a more privileged user authenticates and is authorized, the Web Proxy caches
this user identity for different amounts of time depending on the authentication surrogates configured:
this user identity for different amounts of time depending on the authentication surrogates configured:
•
Session cookie. The privileged user identity is used until the browser is closed or the session times
out.
out.
•
Persistent cookie. The privileged user identity is used until the surrogate times out.
•
IP address. The privileged user identity is used until the surrogate times out.
•
No surrogate. By default, the Web Proxy requests authentication for every new connection, but
when re-authentication is enabled, the Web Proxy requests authentication for every new request, so
there is an increased load on the authentication server when using NTLMSSP. The increase in
authentication activity may not be apparent to a user, however, because most browsers will cache
the privileged user credentials and authenticate without prompting until the browser is closed. Also,
when the Web Proxy is deployed in transparent mode, and the “Apply same surrogate settings to
explicit forward requests” option is not enabled, no authentication surrogates are used for explicit
forward requests and increased load will occur with re-authentication.
when re-authentication is enabled, the Web Proxy requests authentication for every new request, so
there is an increased load on the authentication server when using NTLMSSP. The increase in
authentication activity may not be apparent to a user, however, because most browsers will cache
the privileged user credentials and authenticate without prompting until the browser is closed. Also,
when the Web Proxy is deployed in transparent mode, and the “Apply same surrogate settings to
explicit forward requests” option is not enabled, no authentication surrogates are used for explicit
forward requests and increased load will occur with re-authentication.
Note
If the Web Security appliance uses cookies for authentication surrogates, Cisco recommends enabling
credential encryption.
credential encryption.
IP-based
Yes
Yes
Yes
Yes
Yes
Yes
Cookie-based
Yes
Yes***
Yes***
Yes
No/Yes**
Yes***
Surrogate Types
Credential Encryption Disabled
Credential Encryption Enabled
Protocol:
HTTP
HTTPS
Native FTP
HTTP
HTTPS
Native FTP
No Surrogate
NA
NA
NA
NA
NA
NA
IP-based
Yes
No/Yes*
No/Yes*
Yes
No/Yes*
No/Yes*
Cookie-based
Yes
No/Yes**
No/Yes**
Yes
No/Yes**
No/Yes**
Surrogate Types
Credential Encryption Disabled
Credential Encryption Enabled