topic Re: authetication override in General Topics

authetication override

jdprovine — Fri, 14 Sep 2018 20:04:20 GMT

Why is it necessary to enter "generate cookie for authentication override and accept cookie for the authentication override on both the portal and gateway? I would think it would make more sense to select generate cookie for authentication override on the portal and accept cookie for the authentication override on the gateway.

I am also not sure what you have to put authentication method on both the portal and the gateway.

Re: authetication override

Remo — Fri, 14 Sep 2018 23:04:54 GMT

Hi @jdprovine

If you only need the cookie for a better user experience during one login, then it is enough if you only generate the cookie ond the portal and accept it on the gateway.

If you have for example the requirement that a login should be valid for 7 days so that the user only has to log in again if he did not connect for 7 days, then I would also generate the cookies on the gateway. This way the cookie will also be renewed in case the portal is not available. Also because of that reason (portal not available) I would configure portal and gateway with the same authentication - to keep the authentication as you need it also in cases where a client (for whatever reason) skips the portal and connects to the gateway directly.

Hope this makes sense.

Re: authetication override

Mick_Ball — Sat, 15 Sep 2018 17:16:21 GMT

Yes as per mr remo....

generate on portal and accept on gateway.

whatever auth you have on the portal, set same on the gateway.

cookie overide will prevent user having to authenticate again on gateway but needs to be there if portal is ever unavailablle

because client will use cached portal info and connect directly to the gateway(s) without a cookie.

pretty much repeated what @Remo already stated but im gonna post anyhows...

Re: authetication override

jdprovine — Mon, 24 Sep 2018 13:20:47 GMT

@Mick_Ball @Remo

Yes just to make a better user experience so they don't have to log in twice and no I they would not be logged in for 7 days

So it looks like generate cookie on the portal and accept onthe gateway is the best way to go for me. I have both radius and OTP set on both the portal and the gateway. I have both native clients and globalprotect clients using the VPN.

Re: authetication override

Mick_Ball — Mon, 24 Sep 2018 16:55:27 GMT

Bingo!

Re: authetication override

jdprovine — Tue, 25 Sep 2018 15:14:58 GMT

@Remo @Mick_Ball

I configured this and it worked just the way I wanted wooohooo

generate on portal and accept on gateway.

Re: authetication override

Mick_Ball — Tue, 25 Sep 2018 15:22:13 GMT

@jdprovine

Congratulations, you have earned a new badge...