Use Client Re-authentication

Configure and setup Client Re-authentication

The Netskope Client can require a user to re-authenticate for access to private apps. IdP federation must be configured to use this feature. The Client and IdP prerequisites are:

To configure Client re-authentication:

The Netskope Client menu shows when re-authentication is enabled, and allows you to re-authenticate by clicking that option on the menu.

If the interval expires, the Netskope Client prompts the IdP sign-in window for re-authentication. If the grace period expires, the Netskope Client disconnects from Netskope Private Access.

Use the System Browser for NPA Re-authentication

Starting with Netskope Client R140, you can configure NPA re-authentication to use the operating system’s default browser after the Client is installed. You no longer need to enable the system browser only through Netskope Client installation parameters.

The setting can be enabled separately for Windows and macOS. It applies to all supported devices on the selected operating system.

Note: This setting controls the browser used for NPA re-authentication. It does not change the browser used for initial Client enrollment or other Netskope authentication flows.

Why Use the System Browser?

The system browser provides the following benefits:

• Support for browser-based authentication methods such as FIDO2, WebAuthn, passkeys, and platform authenticators.
• Compatibility with identity provider features that might not be available in an embedded browser.
• Access to existing browser sessions, cookies, and single sign-on integrations.
• Compatibility with enterprise browser policies, password managers, accessibility features, and authentication extensions.
• A familiar authentication experience for users.

The availability of a previously established sign-in session depends on the browser, identity provider, authentication policy, and whether the browser session is ephemeral.

Prerequisites

Before enabling the system browser:

• Configure NPA Client re-authentication. See Use Client Re-authentication.
• Configure IdP federation for the tenant.
• Ensure https://nsauth-<tenant-URL> is publicly accessible.
• Install a supported R140 or later Netskope Client on the endpoint.
• Configure a supported default browser:
  • Windows: Microsoft Edge, Google Chrome, or Mozilla Firefox.
  • macOS: Safari, Microsoft Edge, or Google Chrome. Firefox is not supported as the system browser on macOS.
• Review the user-prompt considerations in Manage Authentication Prompts before enabling the setting across the tenant.

Enable the System Browser

This setting is a Global Attribute and applies to all users and devices on the selected operating system.

1. Go to Settings > Security Cloud Platform > Netskope Client > Client Configuration.
2. Click Global Attributes.
3. Select the Private App tab.
4. Under Security & Authentication, enable one or both of the following options:
   • Enable Default Browser for NPA Re-authentication (Windows)
   • Enable Default Browser for NPA Re-authentication (Mac)
5. Save the configuration.
6. Allow the updated Client configuration to propagate to the endpoints.

The next time NPA requires the user to re-authenticate, Netskope Client opens the operating system’s default browser. After the user completes IdP authentication, control returns to Netskope Client.

If the configured re-authentication grace period expires before authentication is completed, Netskope Client disconnects the user from Netskope Private Access.

Manage Authentication Prompts

The prompts associated with system-browser authentication differ between macOS and Windows.

macOS Web Authentication Consent Dialog

On macOS, the operating system might display the following consent dialog when Netskope Client starts a system-browser authentication session:

“Netskope Client” Wants to Use “<domain>” to Sign In

This dialog is generated by Apple’s ASWebAuthenticationSession framework. It informs the user that Netskope Client and the authentication website will share browser sign-in information.

The dialog is an operating-system security control and cannot be pre-approved using a general macOS MDM restriction.

Suppress the Dialog with an Ephemeral Session

To avoid the dialog, configure Netskope Client to request an ephemeral browser session:

preferephemeral=true

Deploy this parameter to managed Mac devices through the supported Netskope Client configuration script and your MDM solution. For the Netskope parameter syntax, see External Browser-based Authentication.

MDM deployment references:

• Jamf Pro: Running Scripts Using a Policy
• Microsoft Intune: Deployment guide to manage macOS devices

Important: An ephemeral session does not share cookies or other browsing data with the user’s regular browser session. Suppressing the consent dialog can therefore prevent the authentication flow from reusing an existing browser SSO session. Users might need to authenticate to the IdP more frequently. Apple describes this behavior in prefersEphemeralWebBrowserSession.

Choose the configuration based on the required user experience:

The httpmethod=get parameter addresses redundant Safari WebAuth.html confirmation notifications. It does not control the Apple web authentication consent dialog.

Windows External Protocol Prompt

Windows does not display an equivalent to the Apple web authentication consent dialog when Netskope Client opens the system browser.

After authentication, the browser might display an external protocol launch prompt when the authentication page returns control to Netskope Client. Depending on the browser, the prompt can resemble:

This site is trying to open Netskope Client.

Managed browsers can suppress this prompt by allowing the Netskope Client callback protocol from the tenant’s authentication origin.

Configure the browser’s AutoLaunchProtocolsFromOrigins enterprise policy with:

• Protocol: netskopeclient
• Allowed origin: The exact Netskope authentication origin for the tenant, such as https://nsauth-acme.goskope.com

Example policy value:

[
  {
    "allowed_origins": [
      "https://nsauth-acme.goskope.com"
    ],
    "protocol": "netskopeclient"
  }
]

Replace the example origin with the authentication origin for your tenant.

Use the applicable browser documentation:

• Microsoft Edge AutoLaunchProtocolsFromOrigins policy
• Google Chrome AutoLaunchProtocolsFromOrigins policy
• Mozilla Firefox AutoLaunchProtocolsFromOrigins policy

For Microsoft Intune deployment guidance:

• Configure Microsoft Edge policies with Intune
• Manage Chrome with the Intune Settings Catalog

Security recommendation: Allow the netskopeclient protocol only from the exact Netskope authentication origin or origins used by your tenant. Do not use an unrestricted wildcard unless required and approved by your security team.

The policy name and value format are similar across Edge, Chrome, and Firefox, but deployment procedures differ by browser and MDM platform.

Verify the Configuration

1. Confirm that a supported browser is configured as the operating system’s default browser.
2. Trigger NPA re-authentication from the Netskope Client menu, or wait for the configured re-authentication interval to expire.
3. Confirm that the default browser opens the configured IdP sign-in page.
4. Complete authentication.
5. Confirm that control returns to Netskope Client and that Private Access reconnects or remains connected.
6. If prompt-suppression policies are deployed, confirm that the expected consent or external-protocol prompt does not appear.

For managed Chromium browsers, verify the applied policies from:

• Microsoft Edge: edge://policy
• Google Chrome: chrome://policy

For Firefox, use about:policies.

Disable the System Browser

To return NPA re-authentication to the Netskope Client’s embedded browser:

1. Go to Settings > Security Cloud Platform > Netskope Client > Client Configuration.
2. Click Global Attributes.
3. Select the Private App tab.
4. Clear the Windows or Mac default-browser option.
5. Save the configuration.

A Client reinstall is not required. Allow the updated configuration to propagate to the endpoints.

Troubleshooting

Re-authenticate on Logon

Netskope Private Access supports the ability to force a user to re-authenticate into the Netskope Client if the user’s device has restarted, or if the user logs out of the PC and logs back into the device. Contact Support to enable this functionality in your tenant.