Bypassing authentication settings

Related topics:

Bypassing certificate verification

The following options are available in this section:

Bypassing authentication for cloud-based applications

Bypassing authentication and filtering for user agents or sites

Bypassing authentication and filtering for internal networks. This option is available only if you have an I Series appliance, or a supported edge device that connects to the cloud service.

Bypassing authentication for cloud-based applications

If your organization uses Microsoft Office 365, select the Office 365 box under Cloud Applications to bypass authentication for these services and ensure seamless operation.

Bypassing authentication and filtering for user agents or sites

Some applications cannot authenticate with the cloud service. This might occur with applications such as instant messaging programs, antivirus updates, or software update services.

The Authentication Bypass tab on the Web > Settings > Bypass Settings page enables you to add and edit custom settings to change the default behavior for failing applications or websites that cause problems with authentication.

To bypass authentication for particular applications or sites that do not properly handle authentication challenges, you can specify user agents, domains, URLs, or a combination of these.


	Tip A user agent is identified by a string sent from your browser or Internet application. This identifies which browser or application you are using, its version number, and details about your system, such as the operating system and version. The destination server can use this information to provide content suitable for your specific browser or application. For example, this is the user agent information for Firefox: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.6) In this example, Windows NT 5.1 indicates that the operating system is Windows XP, and the language setting is US English.

To add a setting for an application or site:

On the Authentication Bypass tab, click Add under User Agents & Destinations.

Enter a Name for the rule. This name appears in the Authentication Bypass list on the Bypass Settings page, and you can click on it at a later date to edit your settings.

Select the Authentication method for the rule. Note that you can only select a fallback option for the authentication type configured in the policy - for example, if the policy specifies only NTLM identification, you can select Basic or No authentication, but not Form login.

Use defaults: Uses your default authentication method.

NTLM: Uses NTLM identification for the specified user agent(s) and destination(s). If an application is not NTLM-capable, basic authentication will be used instead. For more information about NTLM identification, see NTLM transparent identification.


	Note You must have NTLM identification enabled for your account to use this option.

Form login: Displays the secure login form to users before they use their cloud credentials to proceed over a secure connection. For more information, see Access Control tab.

Basic: Uses the basic authentication mechanism supported by many web browsers. No welcome page is displayed. For more information on basic authentication, see Access Control tab.

Welcome page: Displays a welcome page to users before they use basic authentication to proceed. The welcome page is configurable in each policy on the Access Control tab. Note that the welcome page is not available for traffic from I Series appliances. For more information, see Pre-logon welcome page.

No authentication: Bypasses all authentication and identification methods in the cloud. Select this option for Internet applications that are incapable of authentication.

Content filtering is enabled by default. Optionally, you can bypass all content filtering for the specified user agent(s) and destination(s) by selecting Disabled.


	Warning We strongly recommend you do not disable content filtering unless it is for applications and sites that do not work with the cloud service and that you trust implicitly. Disabling content filtering overrides all other filtering rules, including web category filtering actions. This means that all content is allowed. This could allow viruses and other malware into your network.

Define the user agents, if any, for the rule:

If the application does not send a user agent string to the Internet, select No user agent.


	Note This option will match against all applications that do not send a user agent. In this case, we recommend you refine the rule by entering one or more URLs or domains in the Destination sites field.

To apply the rule to all user agents, select All user agents. You might want to do this if you are setting up a custom rule that applies to all browsers on all operating systems in your organization.

If you want to apply the bypass rule to one or more user agents, select Specific user agents, and enter each user agent on a separate line. Use the asterisk wildcard to match one line to multiple user agent strings, for example Mozilla/5.0*.

Define the destination sites (if any) for the rule:

To match against all domains and URLs, select All destinations. You might want to do this if you are setting up a custom rule that applies to a specific user agent that accesses multiple sites.

To apply the rule to one or more sites, select Specific destinations, and enter each URL or domain on a separate line. URLs must include the protocol portion (http://) at the beginning and a forward slash (/) at the end - for example, http://www.google.com/. If these elements are not present, the string is treated as a domain. Domains cannot include a forward slash at the end - for example, mydomain.com.

Use the asterisk wildcard to match one line to multiple destinations: for example, entering *.mydomain.com would match against all domains ending in 'mydomain.com.'

Click Save.

To view the user agents that have made authentication requests via the cloud service, run the User Agents report (under Reporting > Report Catalog > Advanced). If a user agent in this report has a high number of authentication requests, it may be experiencing authentication problems.

Bypassing authentication and filtering for internal networks

If you have an I Series appliance or an approved edge device that connects to the cloud service, you can override policy authentication and content filtering settings based on the IP addresses in your internal networks, so that specific nodes in a network (for example, guest networks) are forced to authenticate using an alternative method, or will not be authenticated at all.

If there is a conflict between the settings in this section and the settings in Bypassing authentication and filtering for user agents or sites, the IP address settings for the internal network take precedence.

To add a setting for an internal network:

On the Authentication Bypass tab, click Add under Internal Network Traffic.

Enter a Name for the rule. This name appears in the internal networks list on the Bypass Settings page, and you can click on it at a later date to edit your settings.

Select the Authentication method for the rule. Note that you can only select a fallback option for the authentication type configured in the policy - for example, if the policy specifies NTLM identification, you can select Basic or No authentication, but not Form login.

Use defaults: Uses your default authentication method.

NTLM: Uses NTLM identification for the specified internal network(s). If an application is not NTLM-capable, basic authentication will be used instead. For more information about NTLM identification, see NTLM transparent identification.


	Note You must have NTLM identification enabled for your account to use this option.

Form login: Displays the secure login form to users before they use their cloud credentials to proceed over a secure connection. For more information, see Access Control tab.

Basic: Uses the basic authentication mechanism supported by many web browsers. No welcome page is displayed. For more information on basic authentication, see Access Control tab.

No authentication: Bypasses all authentication and identification methods in the cloud service. Select this option for internal networks that should never use authentication credentials.

Content analysis is enabled by default. Optionally, you can bypass all filtering for the specified internal network(s) by selecting Disabled.


	Warning We strongly recommend you do not disable content filtering unless it is for applications and sites that do not work with the cloud service and that you trust implicitly. Disabling content filtering overrides all other filtering rules, including web category filtering actions. This means that all content is allowed. This could allow viruses and other malware into your network.

To specify the internal network details, click Add.

Enter a name for the network (for example, "Guest Network").

Select the network type. This can be an individual IP address, an IP address range, or a subnet.

Enter the IP address, range, or subnet details.

Click OK when you are done.

Click Save.