This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Web Protection Authentication Timeout

I'm currently using AD SSO backend sync (Web protection/filter in transparent mode).  I have clients of our devices (Windows, Mac, Android) as well as many guest devices (iPhones, iPads, etc.).

Due to this I set the authentication timeout to be 8 hours so users would basically authenticate once a day on their devices (if they aren't on our device the UTM is popping up with a sign-in pop up or window in their browser just as it should).

The issue I'm currently having is we have Chromebooks internally, these cannot pickup the AD SSO like our windows machines, however the "browser" authentication mode works great for them (Device-specific authentication -> Linux).  

The only issue with this is that the chromebook users, since they are being prompt via the browser login, are basically logging in once per device per day -- even if the chromebook user changes: User A is the first user to use chromebook 1 today, they get the prompt and authenticate. User B goes to use chromebook and isn't prompt due to the session still being within the 8-hour window according the firewall and therefore is authenticated as if they were user A.


So ultimately my questions are:
- It doesn't look like there is any way to specific a authentication session timeout per filter policy, profile, or device type - is this true?
- Due to the above would my only option be to set all authentication timeouts to be X amount of time so the chromebooks would need to authenticate per user due to session time? 
- Has anyone else encountered this or something similar and found a good resolution?


This thread was automatically locked due to age.
Parents
  • Are there Any updates?

    We Need it also to Change the Timeout to 8h in another webprofile, because we have a lanprofile (where pooling Notebooks used) and there is Need a timeout of 900sec and a wirelessprofile (seperate Network) for 8h.


    Sophos Platinum Partner 
    Sophos Certified Architect
    (Ceritfied UTM Architect / Certified XG Architect)

  • It's not possible.  Why do you want 8h?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply Children
  • To enter only once per day username + password


    Sophos Platinum Partner 
    Sophos Certified Architect
    (Ceritfied UTM Architect / Certified XG Architect)

  • Why do you want the Username?  Do you have policies based on username?  Have you considered using the Sophos Authentication Agent?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • yes, and its needed because its a school.

    saa is no option, because there are smartphones too.


    Sophos Platinum Partner 
    Sophos Certified Architect
    (Ceritfied UTM Architect / Certified XG Architect)

  • I see.  You're right.  There's only a single aua_timeout and no way to have multiple choices.

    Could you do the employee devices with AD-SSO and just have the students use Transparent with Browser Authentication?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • I've configured the browser variant. but after 900sec no surfing there will be the timeout. i configured it now with another way.

    deactivatet authentication for the wireless lan for the byod, implemented an hotspot with backend auth and set the authenticationperiode for 24h. the only one problem is, that i cant difference the userpolicys for surfing, but in this scenario isn't a problem .)

     

    greetings


    Sophos Platinum Partner 
    Sophos Certified Architect
    (Ceritfied UTM Architect / Certified XG Architect)