Proxy user authentication

Security > Proxy user authentication

Proxy user authentication

Help | Content Gateway | Version 7.7.3

Related topics:

Browser limitations

Transparent proxy authentication settings

Integrated Windows Authentication

Legacy NTLM authentication

LDAP authentication

RADIUS authentication

Multiple realm authentication

Mac and iPhone/iPad authentication

Content Gateway supports several methods of authenticating users before their requests are allowed to proceed. These methods can be used together with Websense Web Security user identification features to provide fallback should proxy user authentication become unavailable.

In both explicit and transparent proxy modes, Content Gateway supports user authentication with:

Integrated Windows Authentication (with Kerberos)

Legacy NTLM authentication (NTLMSSP)

LDAP authentication

RADIUS authentication

Multiple realm authentication

In addition, Content Gateway supports Multiple realm authentication, to authenticate:

Distinct sets of IP addresses against specific domains

Traffic on specific ports against specific domains (explicit proxy only)

Specific Request header User-Agent values against specific domains

Combinations of the above (proxy port with explicit proxy only)

For each realm (definition below), an authentication method (Integrated Windows Authentication, NTLM, or LDAP) is specified. With this feature, multiple methods can be used to authenticate users in multiple realms.


	Important Your deployment doesn't have to have multiple realms to take advantage of multiple realm authentication. One reason to enable multiple realm authentication and create authentication rules, is to specify User-Agents that must authenticate. This is usually a list of browsers. If a User-Agent doesn't match a rule, and no other rule matches based on other values, the request bypasses authentication. See Multiple realm authentication.

Terms in the context of multiple realm authentication

A domain is a Windows Active Directory domain.

A realm is a Windows Active Directory domain that does not have an outbound trust relationship with other domains. It therefore requires that its members be authenticated by a domain controller within the domain.

Selecting the authentication method

The authentication method is selected in the Authentication section of the Configure > My Proxy > Basic page. Configuring authentication for multiple realm environments begins with selecting the Multiple Realm Authentication option.

Supported domain controllers and directories

Windows NT domain controllers

Windows 2003 and 2008 Active Directory

Novell eDirectory 8.7 and 8.8 (LDAP only)

Oracle DSEE 11g, Sun Java 7 and 6.2 (LDAP only)

Best practices when using Windows Active Directory

If you have one Active Directory domain, or if all of your Active Directory domains share inbound and outbound trust relationships, the best option is to use Integrated Windows Authentication. However, if you want to control authentication based on User-Agent, use must use multiple realm authentication.

If you have multiple realms and user authentication is a requirement, you must use the multiple realm option. For details, including a discussion of policy application limits, see Multiple realm authentication.

If user identification is sufficient, you can use one of the Web Security user identification options. See the section titled User Identification in TRITON -- Web Security Help.

Transparent user authentication

Content Gateway supports both transparent (Single Sign-On) and interactive (prompted) authentication. Transparent authentication is supported with Integrated Windows Authentication and Legacy NTLM. Some browsers provide only limited support. See Browser limitations.

On Windows networks, Single Sign-On allows users to sign on only once so that they can transparently access all authorized network resources. Therefore, if a user has already logged on to the Windows network successfully, the credentials specified during Windows logon are used for proxy authentication and the user is not prompted again for a username and password.