Description

Authentication fails if the user doesn't exist locally. The external auth server, where the user exists, doesn't get queried at all.

Symptoms

  • User is expecting their Pulse users to get authenticated by next external authentication server when the authentication fails with the first auth method and :
    • [access profile authentication-order]  hierarchy is configured with authentication-order to include more than one authentication methods.
  • The users are unable to get authenticated as fallback external auth servers are not used by SRX.

Solution

As of the current design, the authentication-order under different hierarchies would work as below :

 

  • For the [system authentication-order] the SRX _WILL_ try the next auth provider even if it received a reject from the first one.
  • For the [access profile authentication-order] the SRX _WILL_NOT_ try the next auth provider if it received a reject from the first one.

 

Modification History

  • Aug 18 2023 : Article created.
  • Aug 19 2023 :  Article published.