Edge SWG: Incorrect username mapping on exception pages with Origin IP Redirect

Products

• ISG Proxy

Issue/Introduction

When using Edge SWG (ProxySG) in transparent mode, users may intermittently see incorrect usernames or hostnames on custom exception pages after switching network connections. This behavior occurs because the proxy associates the authenticated user identity with the client's IP address rather than a persistent session token.

This issue is frequently observed when users switch between network environments, such as from corporate Wi-Fi to a mobile hotspot, causing the proxy to misidentify the authenticated user.

Environment

 

• Edge SWG (ProxySG) deployed in Transparent Mode.

• Authentication configured using Origin IP Redirect.

 

Cause

The proxy is currently configured to use "Origin IP Redirect," which caches the authenticated user's identity to their current IP address. When a user switches networks, their previous IP address is returned to the DHCP pool and re-assigned to a new user. The proxy then incorrectly applies the cached identity to the new connection without re-challenging for authentication.

Resolution

To ensure user identities are mapped correctly regardless of IP address changes, implement the following configuration updates:

1. Change the Authentication Surrogate Update the Web Authentication Layer to change the surrogate from IP Address to Cookie (Origin Cookie Redirect). This ensures the user's identity is tied to the browser session rather than the network IP address.

Note: Ensure the proxy is configured to intercept and decrypt the target HTTPS traffic. Origin Cookie Redirect strictly requires SSL interception to read and set the authentication cookie.

2. Verify Virtual URL Configuration Ensure every active authentication realm utilizing a Virtual URL has a strictly unique hostname/URL. Sharing the same Virtual URL across multiple realms causes routing conflicts during the authentication handshake.

3. Address Browser Settings (Incognito/Private Mode) If users experience authentication pop-up prompts while browsing in Google Chrome's Incognito mode, note that this is expected default browser behavior, as private modes block ambient authentication. To allow seamless Single Sign-On (SSO) in Incognito mode, push the following Chrome Enterprise Policy via Windows GPO: AmbientAuthenticationInPrivateModesEnabled.

Additional Information

 

• Broadcom TechDocs: How do I Authenticate Intercepted Transparent SSL Traffic and Add the Username to the Access Log?

• Google Chrome Enterprise Help: Chrome Enterprise Policy – AmbientAuth