Web Authentication MR5

Maybe an addition... When using the Web-Authenticator, I need to add the OTP as well, however this isn't even possible to select in the OTP-settings... 

Hello Alain,

Thank you for contacting the Sophos Community.

What type of authentication is configured in the XG? STAS perhaps?

You can check if it is STAS under Configure >> Authentication >> STAS.

For Web Authentication, OTP  isn’t supported at the moment.

Regards,

No, we don't use STAS ... We tried this as well 'on MR4), and it also blocked all traffic ...

Regarding OTP, maybe it's not supported in theory, but the WebAuthenticator (port 8090) requires it ... So maybe the default AD-SSO tries this as well...

Hello Alain,

What Type of Authentication is configured in your XG?

If STAS  isn’t being used, if it’s enabled, please disable it.

Regards,

Like mentioned before ...It is AD-SSO ... 

And even, whatever it was, it worked on MR4, why would the firmware update cause such an issue.  

Hello Alain,

Thank you for the follow-up and confirmation.

Since you mentioned something about the "Authentication Agent" I got confused.

Please go to System >> Administration >> Device Access 

And make sure AD SSO is enabled for the zones where the authentications are coming from, as well If Client Authentication and Radius is enabled, please disable them.

Also confirm the Authentication Server configured for the Authentication is still reachable (Configure >> Authentication >> Servers)

Regards,

Hello Alain,

Thank you for the follow-up and confirmation.

Since you mentioned something about the "Authentication Agent" I got confused.

Please go to System >> Administration >> Device Access 

And make sure AD SSO is enabled for the zones where the authentications are coming from, as well If Client Authentication and Radius is enabled, please disable them.

Also confirm the Authentication Server configured for the Authentication is still reachable (Configure >> Authentication >> Servers)

Regards,

I disabled Client Authentication and Radius, but it doesn't make a difference ...

Yesterday I also activated STAS again, after reviewing all settings, and again, this morning half of the users ccouldn't work... 

So we still need to work anonymously...

Hello Alain,

Thank you for the follow-up.

I would recommend you to get a case open, to investigate this further, since the logs would need to be check to see what is happening or what is not happening, Feel free to share the Case ID with me once you have it.

If you didn't have STAS configured previously please disable it. as it comes first in the authentication order.

Double-check the SSO configuration https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/learningContent/AuthenticationTurnOnKerberos.html?hl=kerberos 

Also try clearing the cache of the browser of the users if  you’re using HSTS www.thesslstore.com/.../

Regards,