Authentication Methods

Smoothwall uses several authentication methods to identify end users and apply the appropriate policies. When adding Web Proxy Authentication policies, you can use the authentication methods listed in this article.

For more information on Authentication and Transparent or Non-transparent Web Proxying, see the Smoothwall Authentication overview.

Smoothwall uses four broad approaches to authenticate users.

1: No authentication

Users are identified by their IP address and assigned to the Unauthenticated IPs group. This method works with both Transparent and Non-transparent proxies.

2: External authentication

External authentication does not require client applications to authenticate through the proxy, eliminating the need for an authentication bypass. They function independently of the proxy and operate identically across both Transparent and Non-transparent proxies.

Advantages:

Automatic authentication and identification.
No bypass issues when applications cannot respond to a proxy authentication request.
It can be combined with Indirect Proxy Authentication to authenticate users before they start browsing.

Disadvantages:

Additional setup is required.
Users could be misidentified if the setup is incorrect.

Different external authentication methods

IDex: Rather than requesting user identification at sign-in, the IDex Agent uses software installed on domain controllers to automatically transmit user login events directly to the Smoothwall Appliance.
Kerberos Authentication Scripts: When users log in, these scripts notify the Smoothwall Appliance that proxy credential prompts are unnecessary; it automatically renews the user's sign-in status every two minutes.
RADIUS: Logging into the Wi-Fi network simultaneously signs the user in to Smoothwall Filter via RADIUS. This setup is typically applied to Bring Your Own (BYO) hardware.

3: Direct Proxy Authentication

These methods require users to authenticate for each session and new connection. When you use one of these methods, you must add Authentication Exceptions for any software that does not support authentication.

Advantage: Automatic authentication and identification.

Disadvantage: The application must support the authentication method, or you’ll need to bypass authentication.

Terminal Services Compatibility Mode

Each Direct Proxy Authentication method has a standard version and a Terminal Services Compatibility Mode version. Terminal Services compatibility mode is for network devices that use Microsoft Terminal Services (Remote Desktop Connections), allowing multiple users to connect from the same IP address. Every request must be identified to accurately track user activity.

Method	How it works	Policy Type	Support
Negotiate Kerberos/NTLM and Negotiate Kerberos/NTLM (Terminal Services compatibility mode)	The device selects the most secure authentication method it supports between Kerberos and NTLM. Requirements: The user account used to set up Active Directory must be granted permission to connect devices to the domain. All devices must be connected to the same Active Directory domain.	Non-transparent	Deprecated as of June 2025.
Kerberos and Kerberos (Terminal Services compatibility mode)	This method identifies users using the Kerberos keytab.	Non-transparent
Proxy authentication and Proxy authentication (Terminal Services compatibility mode)	This method identifies the user by asking for their username and password when they first use their web browser. These details are encoded in all future requests made through the browser. For each connection, the server can supply an authentication header to the browser.	Non-transparent
NTLM identification and NTLM identification (Terminal Services compatibility mode)	Identifies users by the username used to sign in to their Windows device. Requirements: Smoothwall Filter only supports NTLM authentication for Microsoft operating systems and browsers, even if the platform claims to support NTLM. NTLM identification should only be used on single-domain networks because it doesn’t transmit domain information alongside usernames. Important NTLM identification doesn't verify a user's credentials, so it should only be used where all devices are secured and members of a Windows domain.	Non-transparent	Deprecated as of June 2025.
NTLM authentication and NTLM authentication (Terminal Services compatibility mode)	Identifies users by the username used to sign in to their Windows device and validates their credentials against the domain controller. Requirements: The user account used to set up Active Directory must be permitted to connect devices to the domain. There must be a device account in Active Directory. Smoothwall Filter only supports NTLM authentication for Microsoft operating systems and browsers, even if the platform claims to support NTLM. NTLM authentication should be used only on single-domain networks because it doesn’t transmit domain information with usernames.	Non-transparent	Deprecated as of June 2025.

Warning

You must not use a Terminal Services compatibility mode Authentication Method when using Firewall rules for specific User Groups, as authentication won’t work as expected.

4: Indirect Proxy Authentication

These methods require a user to authenticate only once for the duration of the sign-in timeout value configured in Services > Authentication > Settings.

If you’re using these methods, make sure to:

Advise users to keep their browsers open and active to prevent timeouts.
Set the timeout to a reasonable value. The default timeout is 10 minutes, but your organisation can adjust the duration to strike a balance between convenience and security, so users aren’t prompted to re-authenticate frequently.

Advantages

Automatic authentication and identification.
Compatibility with External authentication.

Disadvantages

Users can be misidentified if another user signs in before the sign-in expires.
Using this method can cause issues with applications that don’t support Indirect Proxy Authentication methods, such as the app ceasing to work or users not being authenticated
The authentication service supports only one user per device IP address.

Method	Description	Policy Type	Support
Redirect users to SSL Login page (with background tab) Redirect users to SSL Login page (with session cookie) Redirect users to non-SSL login page (with background tab) Redirect users to non-SSL login page (with session cookie)	This method authenticates users through a service and then sends their encrypted information to Smoothwall Filter. If no user is signed in, web requests are redirected to the SSL or non-SSL login page where users enter their username and password. Smoothwall Filter stores a session cookie in the user’s browser, eliminating the need for re-authentication and keeping the SSL login page open. This makes it ideal for tablet PCs and other mobile devices that struggle to maintain browser tabs in the background. To sign out securely, the user must click Logout on the SSL Login page. Important We recommend using the Redirect users to SSL Login page (with session cookie) option with an HTTPS certificate. The non-SSL option isn't secure because it uses HTTP to submit the username and password.	Both	Deprecated in Maiden. Redirect users to the SSL Login page (with background tab) Redirect users to non-SSL login page (with background tab) If you need help, contact Smoothwall Support.
Negotiate Kerberos/NTLM (via redirect)	The device selects the most secure authentication method it supports between Kerberos and NTLM. Requirements: The user account used to set up Active Directory must be granted permission to connect devices to the domain. All devices must be connected to the same Active Directory domain. Devices that are not connected to the domain must be configured to require users to enter valid domain credentials.	Transparent	Deprecated as of June 2025.
Kerberos (via redirect)	This method identifies users through the authentication service. If no user is signed in, web requests are redirected to the Kerberos sign-in page, which retrieves the username associated with the user signed in on their Windows-based device.	Both
Smart redirect	This method identifies the user’s device and redirects them to an NTLM authentication or SSL login service. The System > Authentication > User Activity page shows the authentication method used instead of Smart redirect. Note The redirect is based on the User-Agent data in the browser’s HTTP header and is a best-guess scenario, based on pattern matching and compatibility.	Both	Deprecated in Maiden. If you need help, contact Smoothwall Support.
NTLM identification (via redirect)	This method identifies users through the authentication service. If no user is signed in, web requests are redirected to the NTLM sign-in page, which prompts for the username associated with the Windows device.	Both	Deprecated as of June 2025.
NTLM authentication (via redirect)	This method identifies users through the authentication service. If no user is signed in, web requests are redirected to the NTLM sign-in page, which retrieves the username associated with the Windows-based device and validates the credentials with the domain controller.	Both	Deprecated as of June 2025.

Other Authentication methods

Method	Description	Policy Type	Support
Core authentication	Core authentication controls which sites anonymous users can access and lets authenticated users access more. If the user authenticates through the authentication service, Smoothwall Filter applies policies based on their User Group. If the user hasn't authenticated, they're assigned to the Unauthenticated IPs policy group and can be identified by their IP address in reports. If they are shown a Block page, they can authenticate using the SSL or non-SSL login page, whichever your organisation has set up. Important You should use Core authentication together with an External authentication method.	Both
Ident	Ident identifies users with the username returned by a server on their device and does not verify credentials. Once the Ident server identifies the user, Smoothwall Filter filters their web activity according to their User Group.	Both	Deprecated in Maiden. If you need help, contact Smoothwall Support.
Identification by location	This method identifies users by their IP address and assigns a User Group based on the Identification by Location policy.	Both	Deprecated in Maiden. Instead, use Location Objects in the Where step of an Authentication Policy.
Global Proxy using NTLM	This method identifies users with NTLM credentials when they are signed in to the Secure Global Proxy service. You can implement device authentication using certificates on your devices. You can create only one Global Proxy with the NTLM authentication policy, regardless of how many internal interfaces your Smoothwall Appliance has. Global Proxy listens on all external interfaces. Turning on this policy adds the Firewall rules to automatically allow external access to the proxy port.	Non-Transparent	Deprecated as of June 2025.