IWA authchain not working with domain joined machine when not in network

book

Article ID: 113093

calendar_today

Updated On:

Products

CA Single Sign On Secure Proxy Server (SiteMinder) AXIOMATICS POLICY SERVER CA Single Sign On SOA Security Manager (SiteMinder) CA Single Sign-On

Issue/Introduction

We're running CA Access Gateway (SPS), when resource is protected with
"authentication chain" Authentication Scheme, if the first IWA
Authentication fails, the browser doesn't get the HTML Form
Authentication Scheme, but the popup to login. If we cancel this
Pop-Up, then the browser receives return code 403.

But reading the documentation, if the IWA fails, then the browser
should receive the HTML Form to authenticate instead :

IWA Fallback to Forms

If IWA/Windows authentication scheme fails, CA SSO falls back to
Forms-based authentication scheme. This fallback process helps you
combine an IWA authentication scheme and a form/HTML authentication
scheme as the new authentication chain.

How can we fix this ?

Environment

CA Access Gateway (SPS) 12.7

Resolution

UpgradeĀ CA Access Gateway (SPS) to the next CR of 12.7