Cisco Cisco Web Security Appliance S690 User Guide

 – Length of time, in seconds, 

proxy-specific IP-address-to-user mappings are cached; valid values range from five to 1200 
seconds. The default and recommended value is 120 seconds. Specifying a lower value may 
negatively affect proxy performance. 

 – Length of time, in seconds, IP-address 

to-user mappings are cached for IP addresses retrieved from the eDirectory server when there 
are no updates from the server. 

 – The length of time, in seconds, 

to wait for a reply from the Active Directory agent. When the query takes more than this value, 
transparent user identification is considered to have failed. This limits the authentication delay 
experienced by the end user.

 – The length of time, in seconds, to wait 

for a reply from the eDirectory server. When the query takes more than this value, transparent 
user identification is considered to have failed. This limits the authentication delay experienced 
by the end user. 

The Active Directory settings apply to all AD realms using an AD agent for transparent user 
identification. The eDirectory settings apply to all LDAP realms using eDirectory for transparent 
user identification.

If validation fails for any one parameter, none of the values will be changed.

 – This command provides the following AD-related subcommands:

 – Displays the current status of all AD agents, as well as information about their 

connections with the Windows domain controllers.

 – Lists all IP-address-to-user-name mappings stored on the Web Security 

appliance, as retrieved by the AD agent(s). It does not list entries stored on the agent(s), nor 
does it list mappings for which queries are currently in progress.

Obtaining credentials transparently facilitates a single-sign-on environment. Transparent user 
identification is an authentication realm setting.

For Internet Explorer, be sure the Redirect Hostname is the short host name (containing no dots) or the 
NetBIOS name rather than a fully qualified domain. Alternatively, you can add the appliance host name 
to Internet Explorer’s Local intranet zone (Tools > Internet options > Security tab); however, this will be 
required on every client. For more information about this, see 

With Firefox and other non-Microsoft browsers, the parameters network.negotiate-auth.delegation-uris, 
network.negotiate-auth.trusted-uris and network.automatic-ntlm-auth.trusted-uris must be set to the 
transparent-mode Redirect Hostname. You also can refer to 

. This 

 provides general information about changing Firefox parameters.

For information about the Redirect Hostname, see 

, or the CLI 

command