Broken links accessing Web sites with virtual desktops using SAML

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

Users accessing internet via Cloud SWG using IPSEC access method.

Multi user machines with virtual desktops exists and SAML authentication enabled with cookie and not IP surrogates. The IP surrogate best practice IP surrogate cannot be used as all users on that machine will be identified as the first user to authenticate from the host.

When accessing a number of Web sites, the pages do not seem to fully render and include broken links.

Issue seems to appear with both Edge and Chrome browsers.

Developer tools on the browser would indicate CORS related issues (visible from the CONSOLE tab) where certain requests were blocked by the browser due to CORS.

Environment

IPSEC.

SAML authentication with cookie surrogates.

Multi-user host.

Virtual desktops.

Cause

CORS pre-flight requests do not return the expected 200 OK, but 302 response due to SAML authentication redirects.

Resolution

Enable the Chromebook extension originally designed for Chrome and roaming captive portal access method.

Although not designed for Edge or SAML authentication, the logic can handle it and works very well and is fully supported.