WSS Agent SAML Login Window Remains Blank When Using Manual PAC Script

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

When WSS Agent users are connected to a network (such as Guest Wi-Fi) that uses a manual Proxy Auto-Configuration (PAC) script, the WSS login window remains blank even after SAML authentication is completed with IdP and fails to close. Consequently, the WSS Agent cannot complete authentication and it status switches between Connecting to Cloud SWG and Waiting for User Authentication states.

Environment

Product: Cloud Secure Web Gateway (Cloud SWG)

Component: WSS Agent (WSSA)

Configuration: Manual PAC script deployment for roaming/guest networks.

Cause

The current PAC file is not configured to route traffic for the pod.threatpulse.com and *.threatpulse.net domains as DIRECT.

 

Per technical requirements, traffic for these domains must be routed DIRECT. This configuration is necessary to ensure the WSS Login Window closes correctly following successful SAML authentication with the IdP.

Resolution

Update the PAC file to include a bypass snippet for the necessary Cloud SWG domains.

Step-by-Step Instructions:

1.  Locate and open your PAC file for editing.
   
   
2. Add the following shExpMatch logic to the top of your function to ensure these domains return DIRECT before other proxy rules are evaluated:
   javascript
   
   

   if (shExpMatch(host, '*.threatpulse.net') || shExpMatch(host, 'threatpulse.net') || shExpMatch(host, 'pod.threatpulse.com')) {
       return "DIRECT";
   }

3. Save the PAC file and ensure it is updated on the web server hosting the script.
   
   
4. To apply the updated PAC logic, please disconnect and then reconnect the network on the affected client machine.

 

Verification:

Once the PAC file is updated:

Post reconnect the network, the WSS login window should now load properly and post successful SAML authentication completion with IdP, window should close automatically.