This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Authenticated session timeout?

Is there a way to change what seems to be a timeout for how long a user can stay authenicated with UTM?

We have a customer running UTM 9.302-2, with Web Filtering turned on. UTM has been joined to the AD domain, and we have the AD server as an authentication service. Filtering is set to Transparent Mode, Default Authentication is Active Directory SSO. Block access on authentication failure is not selected.

When I use IE, Chrome and FF on their server and access websites, I get prompted for a login to http://firewall (the FQDN is firewall.corp.H*****.com). I can type in AD user credentials and get access to the external website. If I pick another browser on the same system and go to the same site I'm asked for user/pass again. But, when I close that browser and immediately open it and try again I'm not asked for a user/pass. It looks like Web Filtering is caching the useragent and AD user for some period of time? If I try again the next day I'm prompted again. I'm concerned that the clients are going to get frustrated with these prompts unless I tell them how to save the details locally (e.g. in Firefox's password manager).

Can we extend the time before they're prompted for a password again?

This thread was automatically locked due to age.

0 BAlfson over 10 years ago

Hi, cosmos, and welcome to the User BB!

It appears that you are a Sophos reseller. If that's the situation, then you should open a support case with Sophos at https://myutm.sophos.com/.

I never configure AD-SSO in Transparent, so I'm not certain - I think the users should not be asked to log in, and that there's something incorrect in your configuration.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 vilic over 10 years ago in reply to BAlfson

Hi cosmos21,

I think the users should not be asked to log in, and that there's something incorrect in your configuration.

Bob is right here...AD SSO in Transparent mode with "Block access on authentication failure" unchecked should never bring browser authentication popup, even on the first try.
Cancel
Vote Up 0 Vote Down

Cancel
0 Michael Dunn over 10 years ago

cosmos - your SSO (single sign on) is not working.

Please do:
cc get http adsso_redirect_use_hostname

If it is 0 then do:
cc set http adsso_redirect_use_hostname 1

This will change it to login via the UTM hostname instead of the UTM FQDN. Many browser will refuse to do SSO unless the site is part of the "local intranet" and use bare hostname to help detect that.

Also see the following (slightly out of date, assumes FQDN)
How to Configure Active Directory (AD) Single SignOn (SSO) in Transparent Mode on Sophos UTM

If it is already using the hostname and you still are getting popups, you can try the steps from the KB.
Cancel
Vote Up 0 Vote Down

Cancel
0 ahargrove over 10 years ago in reply to Michael Dunn

Many browser will refuse to do SSO unless the site is part of the "local intranet" and use bare hostname to help detect that.

Is this also true when using eDirectory SSO?
Cancel
Vote Up 0 Vote Down

Cancel
0 Michael Dunn over 10 years ago

ahargrove, I don't really know edirectory but I believe it uses a completely different mechanism and never has browser pop-ups.
Cancel
Vote Up 0 Vote Down

Cancel
0 ahargrove over 10 years ago in reply to Michael Dunn

Oh, there's popups, trust me. We get a ton of them with eDir SSO mode.

We are using a WPAD autoconfig file to send the proxy IP to our clients, but not the FQDN. Would this cause the same problem?

We see this behavior in both Chrome and IE.
Cancel
Vote Up 0 Vote Down

Cancel