Cisco Cisco Web Security Appliance S690 User Guide
20-7
Cisco IronPort AsyncOS 7.7 for Web User Guide
Chapter 20 Authentication
Understanding How Authentication Works
How Web Proxy Deployment Affects Authentication
The Web Proxy communicates with clients and authentication servers differently depending on the type
of Web Proxy deployment and the authentication protocol.
of Web Proxy deployment and the authentication protocol.
lists the possible methods of authentication for the various authentication protocols and
deployment type.
The following subsections describe these methods of authentication in more detail.
Explicit Forward Deployment, Basic Authentication
When a client explicitly sends a web page request to a Web Security appliance deployed in explicit
forward mode, the Web Proxy can reply to the client with a 407 HTTP response “Proxy Authentication
Required.” This status informs the client that it must supply valid authentication credentials to access
web resources.
forward mode, the Web Proxy can reply to the client with a 407 HTTP response “Proxy Authentication
Required.” This status informs the client that it must supply valid authentication credentials to access
web resources.
The authentication process comprises these steps:
1.
Client sends a request to the Web Proxy to connect to a web page.
2.
Web Proxy responds with a 407 HTTP response “Proxy Authentication Required.”
3.
User enters credentials, and client application resends the original request with the credentials
encoded in Base64 (not encrypted) in a “Proxy-Authorization” HTTP header.
encoded in Base64 (not encrypted) in a “Proxy-Authorization” HTTP header.
4.
Web Proxy verifies the credentials and returns the requested web page.
lists advantages and disadvantages of using explicit forward Basic authentication.
Transparent Deployment, Basic Authentication
The 407 HTTP response “Proxy Authentication Required” is allowed from proxy servers only. However,
when the Web Proxy is deployed in transparent mode, its existence is hidden from client applications on
the network. Therefore, the Web Proxy cannot return a 407 response.
when the Web Proxy is deployed in transparent mode, its existence is hidden from client applications on
the network. Therefore, the Web Proxy cannot return a 407 response.
Table 20-3
Methods of Authentication
Web Proxy Deployment
Client to Web Security
Appliance
Appliance
Web Security Appliance to Authentication
Server
Server
Explicit forward
Basic
LDAP or NTLM Basic
Transparent
Basic
LDAP or NTLM Basic
Explicit forward
NTLM
NTLMSSP
Transparent
NTLM
NTLMSSP
Table 20-4
Pros and Cons of Explicit Forward Basic Authentication
Advantages
Disadvantages
•
RFC-based
•
Supported by all browsers and most other
applications
applications
•
Minimal overhead
•
Works for HTTPS (CONNECT) requests
•
Password sent as clear text (Base64) for
every request
every request
•
No single sign-on