Overview
Use this reference to find your network integration method. Then see the user experience it creates in F5 Workforce AI Security. Each method section, except Claude Code Model Router, opens with a table that uses the same rows. The rows cover the browser experience, the native application experience, and the requirements. Notes after a table hold the longer explanations.
For what each connector setting does, see Understanding the Proxy Connector (PAC).
Proxy connectors use proxy auto-configuration (PAC) file URLs. Their sections use one column for each Authentication Type value. The Authentication Type values are User, Connector, and User with Connector Fallback.
Three ways Workforce AI Security identifies users
The login that a user sees depends on how Workforce AI Security identifies them. Proxy connectors use all three. Domain Name System over Hypertext Transfer Protocol Secure (DoH) uses only the browser login.
Experience | Browser login | Globally unique identifier (GUID) login | Email identification |
What the user sees | A redirect to log in, then back. | A login prompt. | No prompt. |
Where it applies | One browser. | All browsers and apps on the system. | All browsers and apps on the system. |
How long it lasts | Until 30 days with no AI visits. | 5 days. | Not applicable. |
What prompts the user again | Cleared cookies or history, a private window, or a new browser. | The 5-day limit. | Not applicable. |
Email identification needs the Allow Email Identification in PAC File URL setting Enabled. When the setting is Disabled, an email address works like a GUID.
Connectors for secure access service edge
This section covers Cloudflare, Netskope, and Zscaler with the X-Authenticated-User (XAU) header. The vendor adds the header to each request.
Experience | Secure access service edge (SASE) with XAU |
Browser: login prompt | None. |
Browser: how often | Not applicable. |
Browser: User Activity shows | The user ID from the XAU header. |
Native app: login prompt | None. |
Native app: how often | Not applicable. |
Native app: User Activity shows | The user ID from the XAU header. |
Requirements | See notes 1 through 3. |
Notes:
Note 1. The header carries the user ID, often an email address. The tenant needs the matching SASE connector with Enable X-Authenticated-User Header Enabled.
Note 2. Netskope and Zscaler requests must come from a known IP address of that vendor. Cloudflare uses the
X-SP-Connector-IDheader for validation instead. Cloudflare covers only devices that run the Cloudflare One Client.Note 3. The Workforce AI Security root certificate authority (CA) goes on endpoints. Without it, users see certificate warnings. Netskope and Zscaler also need it in the SASE configuration. Cloudflare doesn't.
Proxy connector with an email address
The PAC file URL carries the user's email address in the email= parameter. The Allow Email Identification in PAC File URL setting on the connector controls the behavior.
When the setting is Enabled, users get the experience in the following table.
Experience | Enabled |
Browser: login prompt | None. |
Browser: how often | Not applicable. |
Browser: User Activity shows | The user, identified by email address. |
Native app: login prompt | None. |
Native app: how often | Not applicable. |
Native app: User Activity shows | The user, identified by email address. |
Requirements | Connector or User with Connector Fallback, and the root CA. |
When the setting is Disabled, the email address works like a GUID. Use the experience in the next section.
Proxy connector with a globally unique identifier
The PAC file URL carries a GUID in the id= parameter. A GUID is user authentication. It doesn't require a specific Authentication Type.
Experience | User | Connector | User with Connector Fallback |
Browser: login prompt | Yes. | None. | Yes. |
Browser: how often | Every 5 days. | Not applicable. | Every 5 days. |
Browser: User Activity shows | The user. | The Connector user. | The user. |
Native app: login prompt | None. The GUID login covers apps. | None. | None. The GUID login covers apps. |
Native app: how often | Every 5 days, shared with browsers. | Not applicable. | Every 5 days, shared with browsers. |
Native app: User Activity shows | The user. | The Connector user. | The user. Before the first login, the Connector user. |
Requirements | The | The | The |
Proxy connector with no identifier
The PAC file URL carries no GUID and no email address. Users see only the browser login.
Experience | User | Connector | User with Connector Fallback |
Browser: login prompt | Yes. | None. | Yes, when the user opens an AI service. |
Browser: how often | Once per browser, then silent refresh (note 1). | Not applicable. | Same as User. |
Browser: User Activity shows | The user. | The Connector user. | The user. Otherwise, the Connector user. |
Native app: login prompt | None. The apps don't work (note 2). | None. | None. |
Native app: how often | Not applicable. | Not applicable. | Not applicable. |
Native app: User Activity shows | Nothing. The apps don't work. | The Connector user. | The Connector user. |
Requirements | The root CA. | The root CA. | The root CA. |
Notes:
Note 1. The browser login refreshes silently. It ends after 30 days with no AI visits. It also ends when the user clears cookies or history, uses a private window, or opens a new browser.
Note 2. Native apps can't redirect to a login page, so a browser login alone doesn't cover them.
Clients that don't support Transport Layer Security (TLS) proxy connections, such as Safari on macOS, always get the User experience. This applies to every Proxy connector section. Workforce AI Security can't identify the user from the traffic of these clients.
Domain Name System over Hypertext Transfer Protocol Secure
DoH is for demos and testing only. For production, use a Proxy connector or a SASE connector. DoH redirects traffic from a web browser. You set up the browser with the Workforce AI Security DoH server. Users can bypass DoH.
Experience | DoH in the browser |
Browser: login prompt | Yes. A redirect to log in, then back. |
Browser: how often | Once per browser, then silent refresh (note 1). |
Browser: User Activity shows | The user. |
Native app: login prompt | Not supported (note 2). |
Native app: how often | Not applicable. |
Native app: User Activity shows | Not applicable. |
Requirements | A DoH-capable browser and the Workforce AI Security root CA. |
Notes:
Note 1. The browser login refreshes silently. It ends after 30 days with no AI visits. It also ends when the user clears cookies or history, uses a private window, or opens a new browser.
Note 2. DoH doesn't support connector authentication, so native and desktop apps can't use it.
For setup steps, see these articles:
Claude Code Model Router
The Model Router covers Claude Code only. Developers install the Claude Code Helper to send Claude Code traffic through the Model Router. On first use, the helper opens a browser for a one-time device login. Later sessions don't prompt.
The Model Router works independently of the Proxy connector. The Authentication Type setting doesn't change what the developer sees.
References
For more information, see: