WSS Agent users experience " Authentication Error - page load error: Timeout " errors at new on-premise location when authenticating using SAML
Article ID: 446462
Updated On:
Products
Issue/Introduction
Multi-national using WSS Agents globally so that users can access internet sites via Cloud SWG.
After rolling out new users at a particular location, all worked fine initially.
Starting on a particular date, users at a particular office location could not longer authenticate via their SAML Identity provider (Microsoft Entra). No login page was displayed and a blank page appeared instead. No changes were documented on either the Cloud SWG side, or WSS Agent side of things.
Traffic to the SAML IDP server is set to be sent into Cloud SWG (although we tested with bypasses and saw similar results).
The same user could take laptop home where all worked fine.
Tried to use dpOverride to connect to another POP but the same problem remained.
HAR files shows network level comms issues accessing Entra endpoints.
WSS Agent diagnostic logs reported "Authentication Error - page load error" constantly.
Environment
Microsoft Entra.
WSS Agent.
Cause
Having two DNS servers, with one being from HQ and not local, seemed to trigger the issue.
Resolution
Two options exist in this environment:
- Make sure that the DNS servers defined response quickly to all DNS requests: Network Admin had a local DNS server but replaced one of the remote DNS servers with another remote DNS server that was geographically much closer to the user.
- Upgrade WSS Agent to the Symantec Enterprise Agent (ESA).
Additional Information
Although unsure as to why DNS proved decisive, one suspects that Webview may have timed out.
The WSS Agent diagnostic logs showed that the authentication process started, but never completed and timeout errors appeared instead.
[05-28-2026 19:34:15 (UTC+10:00)]: CTC Response ACTIVE(GEOIP) - egress: #.#.#.# GAUSY-34.40.220.241 GAUME-34.129.194.65 geolocation: AU NSW Sydney
[05-28-2026 19:34:16 (UTC+10:00)]: Attempting to connect to GAUSY via UDP
[05-28-2026 19:34:16 (UTC+10:00)]: CA Tunnel#1(unauthenticated): connecting to 34.40.220.241
[05-28-2026 19:34:16 (UTC+10:00)]: CA Tunnel#1(unauthenticated): status:SUCCESS-authorized
[05-28-2026 19:34:16 (UTC+10:00)]: Tunnel#1(unauthenticated) connected to concentrator: 34.40.220.241 (GAUSY-UDP), Nat IP: #.#.#.#, RcvBuf: 2097152
[05-28-2026 19:34:16 (UTC+10:00)]: Connection to WSS successful - Tunnel#1
[05-28-2026 19:34:16 (UTC+10:00)]: Waiting for user authentication (unauthenticated)
[05-28-2026 19:44:01 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:44:23 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:44:23 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:44:23 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:44:44 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:44:45 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:45:06 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:45:06 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:45:27 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:45:27 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:45:48 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:45:48 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:46:09 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:46:09 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:46:30 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:46:30 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:46:51 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:46:51 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:47:12 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:47:13 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:47:33 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:47:34 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:47:54 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
[05-28-2026 19:47:55 (UTC+10:00)]: (Notifier) Authentication Error - page load error: Timeout (7)
When the failure occurred, the local login to the Windows device would take up to 7 minutes to complete - this process would involve interaction with a Microsoft AD controller. The assumption is that DNS may have played a role here, although unsure as to why the ESA agent would work fine.
Given that users at home would not be able to contact the AD, we looked at the host machine in more detail. Although there were two DNS servers defined and both DNS servers resolved the responses, the response time for the remote DNS server was extremely high (of the order of seconds). Removing this remote DNS server initially, so that only the local one existed, fixed the issue. We then replaced it with another DNS server in a similar region and that too worked fine. The authentication triggered requests to the Entra endpoints were actually visible, but perhaps the large delays for the local login triggered some timeout on the Microsoft Webview side of things.
Feedback
