X-Authenticate/X-Forward

[MarkPH]

Hi,

My customer's browser homepage is set to their internal webpage and seems to be using SSO. With Explicit mode, they manually configured their browser proxy settings and/or pac file to bypass the local web servers so they can access it directly. Now that they will transition to Transparent mode, they will be removing the pac file and the manual bypass on the browser. Since Proxy authenticates users, accessing the internal web page has become a problem. I remembered that proxy can pass on the credentials or IP to upstream device.

I found https://support.symantec.com/en_US/article.TECH245724.html and used the CPL code below but that doesn't seem to work. Is CPL below still applicable?

define action AddXAuthHeader
set(request.x_header.X-Authenticated-User, "$(user)")
end action AddXAuthHeader

<Proxy>
authenticated=yes action.AddXAuthHeader(yes)

 

I also found an article from WebSense detailing how to forward login credentials by adding Control Request Header action in Web Access policy then using X-Authenticated-User header name and WinNT://$(user.domain)/$(user.name) as value. That did not work when I tested it.

https://www.websense.com/content/support/library/web/hosted/getting_started/bc_xauth.aspx

 

Are the above steps correct or I missed something?

[Migration User]

Hi Mark,

 

             The steps you have followed is to insert an extra header to the requests with the authenticated (i.e. authenticated by proxy) users name. This will not be enough for the Internal server to identify user as it is not currently set to look at this header. The best would be to set the proxy to not attempt authenticate these domains/servers and let the authorization headers flow upstream. Refer https://support.symantec.com/en_US/article.TECH244708.html