Slowness and authentication prompts for Skyhigh Web Gateway users when Dropbox and iCloud applications provide invalid credentials

Technical Articles ID: KB83686
Last Modified: 2023-06-27 05:00:47 Etc/GMT

Environment

Skyhigh Web Gateway (SWG)

NTLM authentication

Summary

Some applications, such as Dropbox and iCloud, provide invalid credentials during the authentication process. This behavior can cause the domain controller to process the authentication request slowly, which leads to slowness, authentication prompts for other users, or both.

Problem

Some indications that this problem exists are as follows:

Users might complain about application slowness followed by an authentication prompt.
An access log or Web Reporter/Content Security Reporter query might report multiple requests by a username of "None."
The mwg-core_Auth.debug.log reports the following error:

Authentication didn't return values, failure ID: 6, authentication failed: 1

Cause

The application provides the username "None" to SWG during the authentication process. When SWG tries to authenticate the "None" user with the domain controller, the domain controller takes five (5) seconds to reply with a user doesn't exist message (STATUS_NO_SUCH_USER).

Because of this five-second delay, pending authentication requests from other clients start to back up in the authentication queue on SWG. This delay and backup of requests results in other clients getting authentication prompts because their authentication request can't be processed. Specifically, it can't be processed within the configured "Authentication Attempt timeout" value in the SWG NTLM engine settings container.

Solution

To resolve this issue, we suggest that you bypass these applications from authentication on SWG. Use the following rules to bypass authentication for the iCloud and Dropbox applications:

iCloud

Criteria: Header.Request.Get("User-agent") matches *iCloudServices.exe* AND URL.host matches *.icloud.com
Action: Stop Rule Set
Dropbox

Criteria: URL.Host matches *.dropbox.com
Action: Stop Rule Set
Rule Placement: The "Stop Rule Set" action bypasses authentication only if you place this rule in the same rule set as your Authentication rule.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Slowness and authentication prompts for Skyhigh Web Gateway users when Dropbox and iCloud applications provide invalid credentials

Environment

Summary

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Slowness and authentication prompts for Skyhigh Web Gateway users when Dropbox and iCloud applications provide invalid credentials

Environment

Summary

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title