>
    How Explicit Proxy Identifies Users
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access
    3. Prisma Access Mobile Users
    4. Mobile Users: Explicit Proxy
    5. How Explicit Proxy Identifies Users
    Download PDF
    Prisma Access

    How Explicit Proxy Identifies Users

    Table of Contents

    How Explicit Proxy Identifies Users

    These are the ways that Prisma Access Explicit Proxy identifies users.
    Where Can I Use This?What Do I Need?
    • Prisma Access (Managed by Strata Cloud Manager)
    • Prisma Access (Managed by Panorama)
    • Prisma Access license
    Explicit Proxy identifies users in the Traffic logs dependent on how the users authenticate with the proxy, as shown in the following table.
    Authentication TypeUser Identification in Traffic Logs
    Users who login using SAML authentication and decryptionThe username.
    Users who login from another proxy that uses X-Authenticated-User (XAU) headers
    XAU header information.
    Explicit Proxy only allows traffic from specific IP addresses to use XAU for authentication. You create an address object and specify the IP addresses where you allow XAU for authentication; then, add the address object in the Trusted Source Address field during Explicit Proxy setup.
    Authenticated cross-origin resource sharing (CORS) requests
    The swg-authenticated-ip-user user.
    Some traffic comes from authenticated users whose browsers can't send cookies or perform authentication redirection, such as CORS requests. In such cases, Explicit Proxy adds the swg-authenticated-ip-user to the Traffic logs.
    Undecrypted traffic (if you have allowed Explicit Proxy to allow undecrypted traffic from IP addresses where users have previously authenticated)
    The swg-authenticated-ip-user user.
    You can specify Explicit Proxy to allow undecrypted traffic from IP addresses where users have authenticated; to do so, specify Decrypt traffic that matches existing decryption rules; for undecrypted traffic, allow traffic only from known IPs registered by authenticated users when you configure Explicit Proxy. In these configurations, Explicit Proxy adds the swg-authenticated-ip-user to the Traffic logs.
    Traffic for domains for which you’ve chosen to bypass authentication
    The swg-known-auth-bypass user.
    When you set up Explicit Proxy, you can choose to bypass authentication from specific domains. The username for traffic from these domains will appear in the logs as swg-known-auth-bypass.

    © 2024 Palo Alto Networks, Inc. All rights reserved.