The Windows Client Authenticator (WCA) allows Windows and IIS users to validate their identity to the Maverics Orchestrator using Windows desktop credentials. WCA runs as an IIS application that authenticates users via NTLM and communicates the result to the Orchestrator over HTTPS. WCA must be used with the Orchestrator — it has no standalone value. The WCA installer is downloaded from your Maverics deployment.
Console terminology: In the Maverics Console, this section is called
Identity Fabric. The YAML configuration uses the connectors key to define
identity provider integrations.
The Windows Client Authenticator connector authenticates users via their Windows desktop credentials using NTLM. Unlike OIDC or SAML connectors, WCA does not use a standard federation protocol — it runs as a dedicated IIS application on a Windows server and communicates directly with the Orchestrator over HTTPS.WCA only supports login functionality. It does not retrieve user attributes beyond the authenticated username. For additional attributes such as email, display name, or group memberships, pair the WCA connector with an Attribute Provider such as Active Directory.
Unified SSO for Windows desktop environments — Extend single sign-on to web applications using existing Windows domain credentials via NTLM, so users on domain-joined machines authenticate seamlessly without additional passwords
Legacy Windows app modernization — Bridge NTLM-authenticated Windows environments with modern cloud IdPs through the Orchestrator, enabling a unified authentication experience across on-premises and cloud applications
Seamless Kerberos/NTLM-to-web SSO — Authenticate users with their Windows desktop session and pass identity to the Orchestrator, eliminating separate login prompts for web applications in enterprise Windows environments
Attribute-enriched Windows authentication — Pair WCA with an Active Directory attribute provider to retrieve group memberships, email, and other directory attributes alongside NTLM authentication
Follow these steps to install and configure the WCA on your IIS server:
1
Run the WCA installer
Run the WCA installer downloaded from your Maverics deployment. The installer creates an IIS application for the WCA.
2
Open IIS Manager
Open IIS Manager and navigate to the WCA application.
3
Configure authentication settings
Under the WCA application’s Authentication settings, enable both Anonymous Authentication and Windows Authentication.
IIS Authentication settings for WCA
WCA v2.x and later requires Anonymous Authentication to be enabled for the /status health endpoint.
4
Configure Windows Authentication providers
Under Windows Authentication > Providers, ensure NTLM is the only enabled provider.
NTLM as the only enabled provider
5
Configure site bindings
Configure the IIS site bindings with HTTPS and the appropriate hostname for your environment. This hostname is the URL you will use in the Orchestrator connector configuration.
When upgrading to WCA v2.x or later, Anonymous Authentication must be enabled in IIS. Previous versions of WCA had Anonymous Authentication disabled. This change is required for the /status health endpoint to function correctly.
The WCA exposes a health endpoint at <hostname>/status that returns OK with HTTP 200 when the WCA application is running correctly. Use this endpoint for monitoring and health checks.
Set a friendly name — The name field is the unique identifier for this connector, referenced by app policies and attribute providers.
Set the URL — The url field must match the hostname binding you configured in IIS (e.g., https://wca.corp.example.com).
Optionally set TLS — If the IIS server uses a self-signed or internal CA certificate, reference a named TLS profile with the tls field. The TLS profile should include the CA certificate via caFile.
By default, browsers prompt users for credentials when accessing the WCA. You can configure browsers to pass Windows credentials automatically for a seamless single sign-on experience.
WCA requires a Layer 4 (network) load balancer for high availability. Do not use a Layer 7 (application) load balancer — Layer 7 load balancers terminate and re-establish TCP connections, which breaks the multi-step NTLM authentication handshake.Use source IP / destination IP / port tuple affinity (sticky sessions based on client IP) to ensure all packets in an NTLM handshake reach the same backend IIS server.
The high availability architecture follows this flow:Client Machines → App Load Balancer → Orchestrator(s) → Network Load Balancer (Layer 4) → IIS Server(s) with WCA
WCA high availability architecture
Using a Layer 7 load balancer in front of WCA servers will cause NTLM authentication failures. NTLM requires an unbroken TCP connection between the client (Orchestrator) and the server (WCA on IIS) across multiple request-response rounds. Layer 7 load balancers proxy at the HTTP level, breaking this connection continuity.
NTLM authentication requires an unbroken TCP connection across multiple request-response rounds. Layer 7 (application) load balancers terminate and re-establish connections, breaking the handshake.Fix: Replace the Layer 7 load balancer with a Layer 4 (network) load balancer. Configure source IP affinity to ensure all packets in a handshake reach the same backend server.
Status endpoint returns 401 or 403
The /status endpoint requires Anonymous Authentication to be enabled in IIS. This is a common issue when upgrading from WCA versions prior to v2.x.Fix: In IIS Manager, navigate to the WCA application’s Authentication settings and enable Anonymous Authentication.
Browser prompts for credentials on intranet
By default, browsers do not automatically send Windows credentials to intranet sites. Users will see a credential prompt on each access.Fix: Configure NTLM seamless authentication in the browser or via Group Policy. See the NTLM Seamless Authentication section above.
WCA installer fails
The WCA installer requires the .NET 7.0.13 Windows Server Hosting bundle. If the bundle is not present, the installer will install the bundle for you, but this may fail if there are network or permission issues.Fix: Manually download and install the .NET 7 Windows Server Hosting bundle before running the WCA installer.
Overview of all identity providers and supported types
Continuity
IdP failover connector (WCA is not supported by Continuity)
Active Directory
Active Directory connector — commonly paired with WCA for attribute retrieval
{"docsConfig":{"theme":"mint","$schema":"https://mintlify.com/docs.json","name":"Maverics Documentation","colors":{"primary":"#1DA1DC","light":"#2FCAFF","dark":"#0086C0"},"logo":{"light":"https://mintcdn.com/strataidentity/GnMIwAgmQ7Rnxm8R/logo/light.svg?fit=max\u0026auto=format\u0026n=GnMIwAgmQ7Rnxm8R\u0026q=85\u0026s=f75039b8474c2403c381ef74fdbee428","dark":"https://mintcdn.com/strataidentity/GnMIwAgmQ7Rnxm8R/logo/dark.svg?fit=max\u0026auto=format\u0026n=GnMIwAgmQ7Rnxm8R\u0026q=85\u0026s=c18e3db0543ce5426f86c06a48cfceba","href":"https://www.strata.io"},"favicon":"https://mintcdn.com/strataidentity/bx_Hbkhp9SuRuU18/favicon.svg?fit=max\u0026auto=format\u0026n=bx_Hbkhp9SuRuU18\u0026q=85\u0026s=7a515a8aae3869956b801d7d0a8a555c","appearance":{"default":"dark","strict":false},"navbar":{"links":[{"href":"https://strataidentity.my.site.com/support/s/","label":"Support"}],"primary":{"type":"button","label":"Console Login","href":"https://maverics.strata.io"}},"footer":{"socials":{"linkedin":"https://www.linkedin.com/company/strata-identity","github":"https://github.com/strata-io","x":"https://x.com/strataidentity","youtube":"https://www.youtube.com/@strataidentity"},"links":[{"header":"Resources","items":[{"label":"Legacy Docs","href":"https://legacy-docs.strata.io"}]},{"header":"Help","items":[{"label":"Status","href":"https://status.strata.io/"},{"label":"Support Center","href":"https://strataidentity.my.site.com/support/s"}]},{"header":"Terms and Policy","items":[{"label":"Privacy Policy","href":"https://www.strata.io/privacy-policy"},{"label":"Trust Center","href":"https://security-trust.strata.io/"},{"label":"Cookie Declaration","href":"https://www.strata.io/legal/cookiebot-declaration"}]}]},"integrations":{"cookies":{"key":"cookieconsent_analytics_allowed","value":"true"}},"errors":{"404":{"redirect":false,"title":"Page not found","description":"Looks like this page has moved or doesn't exist yet. Try searching the docs or head back to the [homepage](/introduction/overview). If you're looking for older content, it might still be on the [legacy documentation site](https://legacy-docs.strata.io)."}},"contextual":{"options":["copy","view","chatgpt","claude","perplexity","mcp","cursor","vscode"],"display":"header"},"styling":{"latex":false},"navigation":{"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"strataidentity","hasAudioNarration":false,"actualSubdomain":"strataidentity","customDomains":["docs.strata.io"],"gitSource":{"type":"github","owner":"strata-io","repo":"docs.strata.io","deployBranch":"main","contentDirectory":"","isPrivate":true,"mountPath":"","label":""},"feedback":{"thumbs":false},"entitlements":{"AI_CHAT":{"status":"ENABLED"},"REMOVE_BRANDING":{"status":"ENABLED"},"CONTEXTUAL_FEEDBACK":{"status":"ENABLED"},"CODE_SNIPPET_FEEDBACK":{"status":"ENABLED"},"WEB_MCP":{"status":"ENABLED"},"NARRATION":{"status":"ENABLED"}},"buildId":"6aeb48d5057e717ec7e9d46c","clientVersion":"0.0.4102","searchFilterCounts":[{"language":"default","tag":"Reference","count":102},{"language":"default","tag":"Orchestration","count":90},{"language":"default","tag":"Guides","count":31},{"language":"default","tag":"Identity Fabric","count":31},{"language":"default","tag":"Configuration","count":18},{"language":"default","tag":"Console Administration","count":12},{"language":"default","tag":"Authentication","count":9},{"language":"default","tag":"Changelog","count":8},{"language":"default","tag":"Config Sources","count":8},{"language":"default","tag":"Secret Providers","count":8}]},"assistantConfig":{"enableAskAiButton":false,"enableStarterQuestions":false,"enableAskAiSearchBar":true},"basePath":"","hasChatPermissions":false,"hasWebMcpPermissions":true,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-rbac-roles","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"rbac-expansion","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"full-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-dual-write","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"approve-review-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-metadata","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"sso-setup-deadline-banner","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-serve","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"live-agents","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"googleFontsInlined":false},"customCss":[{"filePath":"style.css","content":"footer{margin-top:2rem!important}"}],"page":{"pagePath":"reference/orchestrator/identity-fabric/wca","slug":"/reference/orchestrator/identity-fabric/wca","pageMetadata":{"title":"Microsoft Windows Client Authenticator","icon":"windows","description":null,"href":"/reference/orchestrator/identity-fabric/wca"},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx,jsxs:_jsxs}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){const _components={a:`a`,code:`code`,li:`li`,ol:`ol`,p:`p`,pre:`pre`,span:`span`,strong:`strong`,tbody:`tbody`,td:`td`,th:`th`,thead:`thead`,tr:`tr`,ul:`ul`,..._provideComponents(),...props.components},{Accordion,AccordionGroup,Card,CardGroup,CodeBlock,Frame,Heading,Info,Note,OptimizedImage,Step,Steps,Tab,Table,Tabs,Warning}=_components;if(!Accordion)_missingMdxReference(`Accordion`,true);if(!AccordionGroup)_missingMdxReference(`AccordionGroup`,true);if(!Card)_missingMdxReference(`Card`,true);if(!CardGroup)_missingMdxReference(`CardGroup`,true);if(!CodeBlock)_missingMdxReference(`CodeBlock`,true);if(!Frame)_missingMdxReference(`Frame`,true);if(!Heading)_missingMdxReference(`Heading`,true);if(!Info)_missingMdxReference(`Info`,true);if(!Note)_missingMdxReference(`Note`,true);if(!OptimizedImage)_missingMdxReference(`OptimizedImage`,true);if(!Step)_missingMdxReference(`Step`,true);if(!Steps)_missingMdxReference(`Steps`,true);if(!Tab)_missingMdxReference(`Tab`,true);if(!Table)_missingMdxReference(`Table`,true);if(!Tabs)_missingMdxReference(`Tabs`,true);if(!Warning)_missingMdxReference(`Warning`,true);return _jsxs(_Fragment,{children:[_jsx(_components.p,{children:`The Windows Client Authenticator (WCA) allows Windows and IIS users to validate their identity to the Maverics Orchestrator using Windows desktop credentials. WCA runs as an IIS application that authenticates users via NTLM and communicates the result to the Orchestrator over HTTPS. WCA must be used with the Orchestrator — it has no standalone value. The WCA installer is downloaded from your Maverics deployment.`}),`\n`,_jsx(Note,{children:_jsxs(_components.p,{children:[_jsx(_components.strong,{children:`Console terminology:`}),` In the Maverics Console, this section is called\n`,_jsx(_components.strong,{children:`Identity Fabric`}),`. The YAML configuration uses the `,_jsx(_components.code,{children:`connectors`}),` key to define\nidentity provider integrations.`]})}),`\n`,_jsx(Heading,{level:`2`,id:`overview`,children:`Overview`}),`\n`,_jsx(_components.p,{children:`The Windows Client Authenticator connector authenticates users via their Windows desktop credentials using NTLM. Unlike OIDC or SAML connectors, WCA does not use a standard federation protocol — it runs as a dedicated IIS application on a Windows server and communicates directly with the Orchestrator over HTTPS.`}),`\n`,_jsxs(_components.p,{children:[`WCA only supports `,_jsx(_components.strong,{children:`login functionality`}),`. It does not retrieve user attributes beyond the authenticated username. For additional attributes such as email, display name, or group memberships, pair the WCA connector with an `,_jsx(_components.a,{href:`/reference/orchestrator/identity-fabric/activedirectory`,children:`Attribute Provider`}),` such as Active Directory.`]}),`\n`,_jsx(Heading,{level:`2`,id:`use-cases`,children:`Use Cases`}),`\n`,_jsxs(_components.ul,{children:[`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Unified SSO for Windows desktop environments`}),` — Extend single sign-on to web applications using existing Windows domain credentials via NTLM, so users on domain-joined machines authenticate seamlessly without additional passwords`]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Legacy Windows app modernization`}),` — Bridge NTLM-authenticated Windows environments with modern cloud IdPs through the Orchestrator, enabling a unified authentication experience across on-premises and cloud applications`]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Seamless Kerberos/NTLM-to-web SSO`}),` — Authenticate users with their Windows desktop session and pass identity to the Orchestrator, eliminating separate login prompts for web applications in enterprise Windows environments`]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Attribute-enriched Windows authentication`}),` — Pair WCA with an `,_jsx(_components.a,{href:`/reference/orchestrator/identity-fabric/activedirectory`,children:`Active Directory attribute provider`}),` to retrieve group memberships, email, and other directory attributes alongside NTLM authentication`]}),`\n`]}),`\n`,_jsx(Heading,{level:`2`,id:`requirements`,children:`Requirements`}),`\n`,_jsxs(Table,{children:[_jsx(_components.thead,{children:_jsxs(_components.tr,{children:[_jsx(_components.th,{children:`Requirement`}),_jsx(_components.th,{children:`Details`})]})}),_jsxs(_components.tbody,{children:[_jsxs(_components.tr,{children:[_jsx(_components.td,{children:`Operating system`}),_jsx(_components.td,{children:`Windows Server 2008 R2 or later`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:`IIS`}),_jsx(_components.td,{children:`Internet Information Services with web server features enabled`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:`.NET runtime`}),_jsx(_components.td,{children:`.NET 7.0.13 Windows Server Hosting bundle (the installer will install the bundle for you if not already installed)`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:`Permissions`}),_jsx(_components.td,{children:`Administrator privileges on the Windows server`})]})]})]}),`\n`,_jsx(Heading,{level:`2`,id:`installation`,children:`Installation`}),`\n`,_jsx(_components.p,{children:`Follow these steps to install and configure the WCA on your IIS server:`}),`\n`,_jsxs(Steps,{children:[_jsx(Step,{title:`Run the WCA installer`,children:_jsx(_components.p,{children:`Run the WCA installer downloaded from your Maverics deployment. The installer creates an IIS application for the WCA.`})}),_jsx(Step,{title:`Open IIS Manager`,children:_jsx(_components.p,{children:`Open IIS Manager and navigate to the WCA application.`})}),_jsxs(Step,{title:`Configure authentication settings`,children:[_jsxs(_components.p,{children:[`Under the WCA application’s `,_jsx(_components.strong,{children:`Authentication`}),` settings, enable both `,_jsx(_components.strong,{children:`Anonymous Authentication`}),` and `,_jsx(_components.strong,{children:`Windows Authentication`}),`.`]}),_jsx(Frame,{caption:`IIS Authentication settings for WCA`,children:_jsx(OptimizedImage,{src:`https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-iis-authentication.png?fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=a6ba1b052258de860b3d720ea5eef322`,alt:`IIS Authentication settings showing Anonymous Authentication and Windows Authentication both enabled for the WCA application`,\"data-og-width\":`1020`,width:`1020`,\"data-og-height\":`348`,height:`348`,\"data-path\":`images/wca-iis-authentication.png`,\"data-optimize\":`true`,\"data-opv\":`3`,srcset:`https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-iis-authentication.png?w=280\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=7b2d24e0e1c95bca637fbdd06751593c 280w, https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-iis-authentication.png?w=560\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=8a376ae9093f800e3ecabac6c6b06c4e 560w, https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-iis-authentication.png?w=840\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=94572a231ca3581d8e99721ec027202d 840w, https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-iis-authentication.png?w=1100\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=b90662e6192c194417c22c14cfdebd17 1100w, https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-iis-authentication.png?w=1650\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=d335c7f63f83b1e88a1c619388ca914b 1650w, https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-iis-authentication.png?w=2500\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=1d7772f61cb65db08e47788cf864e1dc 2500w`})}),_jsx(Info,{children:_jsxs(_components.p,{children:[`WCA v2.x and later requires Anonymous Authentication to be enabled for the `,_jsx(_components.code,{children:`/status`}),` health endpoint.`]})})]}),_jsxs(Step,{title:`Configure Windows Authentication providers`,children:[_jsxs(_components.p,{children:[`Under `,_jsx(_components.strong,{children:`Windows Authentication`}),` > `,_jsx(_components.strong,{children:`Providers`}),`, ensure `,_jsx(_components.strong,{children:`NTLM`}),` is the only enabled provider.`]}),_jsx(Frame,{caption:`NTLM as the only enabled provider`,children:_jsx(OptimizedImage,{src:`https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-ntlm-provider.png?fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=af35ffeb8238763fa0e7748aae9f2939`,alt:`Windows Authentication Providers dialog showing NTLM as the only enabled provider`,\"data-og-width\":`920`,width:`920`,\"data-og-height\":`768`,height:`768`,\"data-path\":`images/wca-ntlm-provider.png`,\"data-optimize\":`true`,\"data-opv\":`3`,srcset:`https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-ntlm-provider.png?w=280\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=bfddd4cdf6fb056db8e92013cb3db232 280w, https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-ntlm-provider.png?w=560\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=3e423f0ada80d26ba5a461d3a9e7fd78 560w, https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-ntlm-provider.png?w=840\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=bd9df09c122d99bf525cc82471606781 840w, https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-ntlm-provider.png?w=1100\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=fdbab2411ef03b9db676e3a9c42f2410 1100w, https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-ntlm-provider.png?w=1650\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=6d31496aa3994fc6abba7bd76db20cd6 1650w, https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-ntlm-provider.png?w=2500\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=f824392bd0f8b4fe470288608b771a5c 2500w`})})]}),_jsx(Step,{title:`Configure site bindings`,children:_jsx(_components.p,{children:`Configure the IIS site bindings with HTTPS and the appropriate hostname for your environment. This hostname is the URL you will use in the Orchestrator connector configuration.`})})]}),`\n`,_jsx(Heading,{level:`2`,id:`upgrading-from-previous-versions`,children:`Upgrading from Previous Versions`}),`\n`,_jsxs(_components.p,{children:[`When upgrading to WCA v2.x or later, `,_jsx(_components.strong,{children:`Anonymous Authentication must be enabled`}),` in IIS. Previous versions of WCA had Anonymous Authentication disabled. This change is required for the `,_jsx(_components.code,{children:`/status`}),` health endpoint to function correctly.`]}),`\n`,_jsx(Frame,{caption:`Enabling Anonymous Authentication when upgrading`,children:_jsx(OptimizedImage,{src:`https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-upgrade-auth.png?fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=3201992868194f9559635ccf956c8333`,alt:`IIS Authentication settings showing Anonymous Authentication enabled after upgrading to WCA v2.x`,\"data-og-width\":`1020`,width:`1020`,\"data-og-height\":`402`,height:`402`,\"data-path\":`images/wca-upgrade-auth.png`,\"data-optimize\":`true`,\"data-opv\":`3`,srcset:`https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-upgrade-auth.png?w=280\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=50913cad08ae3016ad4aabe95c1d62d2 280w, https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-upgrade-auth.png?w=560\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=b1473c3bc810c6cb25b5cced46652028 560w, https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-upgrade-auth.png?w=840\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=35aae4eb198a3b5016a74722f3628906 840w, https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-upgrade-auth.png?w=1100\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=eec04d0448a35345919fee979d00c6fb 1100w, https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-upgrade-auth.png?w=1650\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=3d73d205ec2b69784906cd5662ac258d 1650w, https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-upgrade-auth.png?w=2500\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=d0afb728c474c247a77e6ad426fe4688 2500w`})}),`\n`,_jsx(Heading,{level:`2`,id:`status-endpoint`,children:`Status Endpoint`}),`\n`,_jsxs(_components.p,{children:[`The WCA exposes a health endpoint at `,_jsx(_components.code,{children:`\u003chostname>/status`}),` that returns `,_jsx(_components.code,{children:`OK`}),` with HTTP 200 when the WCA application is running correctly. Use this endpoint for monitoring and health checks.`]}),`\n`,_jsx(Heading,{level:`2`,id:`setup`,children:`Setup`}),`\n`,_jsxs(Tabs,{children:[_jsxs(Tab,{title:`Console UI`,id:`console-ui`,children:[_jsx(_components.p,{children:`To create a Microsoft Windows Client Authenticator connector in the Maverics Console:`}),_jsxs(_components.ol,{children:[`\n`,_jsxs(_components.li,{children:[`Navigate to `,_jsx(_components.strong,{children:`Identity Fabric`}),` in the Console sidebar.`]}),`\n`,_jsxs(_components.li,{children:[`Click `,_jsx(_components.strong,{children:`Create`}),` and select `,_jsx(_components.strong,{children:`Microsoft Windows Client Authenticator`}),`.`]}),`\n`,_jsxs(_components.li,{children:[`Enter a `,_jsx(_components.strong,{children:`Name`}),` for the connector.`]}),`\n`,_jsxs(_components.li,{children:[`Enter the `,_jsx(_components.strong,{children:`URL`}),` of the WCA server — this must match the IIS site binding hostname (e.g., `,_jsx(_components.code,{children:`https://wca.corp.example.com`}),`).`]}),`\n`,_jsxs(_components.li,{children:[`Optionally enter a `,_jsx(_components.strong,{children:`CA Path`}),` if the IIS server uses a self-signed or internal CA certificate.`]}),`\n`,_jsxs(_components.li,{children:[`Click `,_jsx(_components.strong,{children:`Save`}),`.`]}),`\n`]})]}),_jsxs(Tab,{title:`Configuration`,id:`configuration`,\"data-child-heading-ids\":`[\"configuration-with-maverics\",\"configuration-reference\"]`,children:[_jsx(CodeBlock,{filename:`maverics.yaml`,numberOfLines:`5`,language:`yaml`,children:_jsx(_components.pre,{className:`shiki shiki-themes github-light-default dark-plus`,style:{backgroundColor:`#ffffff`,\"--shiki-dark-bg\":`#0B0C0E`,color:`#1f2328`,\"--shiki-dark\":`#D4D4D4`},language:`yaml`,children:_jsxs(_components.code,{language:`yaml`,numberOfLines:`5`,children:[_jsxs(_components.span,{className:`line`,children:[_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#569CD6`},children:`connectors`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`:`})]}),`\n`,_jsxs(_components.span,{className:`line`,children:[_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:` - `}),_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#569CD6`},children:`name`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: `}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:`wca`})]}),`\n`,_jsxs(_components.span,{className:`line`,children:[_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#569CD6`},children:` type`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: `}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:`windowsclientauthenticator`})]}),`\n`,_jsxs(_components.span,{className:`line`,children:[_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#569CD6`},children:` url`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: `}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:`https://wca-iis2019.testad.local`})]}),`\n`,_jsxs(_components.span,{className:`line`,children:[_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#569CD6`},children:` tls`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: `}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:`wca-tls`})]}),`\n`]})})}),_jsx(Heading,{level:`2`,id:`configuration-with-maverics`,children:`Configuration with Maverics`}),_jsx(_components.p,{children:`After installing the WCA on your IIS server:`}),_jsxs(_components.ol,{children:[`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Set a friendly name`}),` — The `,_jsx(_components.code,{children:`name`}),` field is the unique identifier for this connector, referenced by app policies and attribute providers.`]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Set the URL`}),` — The `,_jsx(_components.code,{children:`url`}),` field must match the hostname binding you configured in IIS (e.g., `,_jsx(_components.code,{children:`https://wca.corp.example.com`}),`).`]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`Optionally set TLS`}),` — If the IIS server uses a self-signed or internal CA certificate, reference a named TLS profile with the `,_jsx(_components.code,{children:`tls`}),` field. The TLS profile should include the CA certificate via `,_jsx(_components.code,{children:`caFile`}),`.`]}),`\n`]}),_jsx(Heading,{level:`2`,id:`configuration-reference`,children:`Configuration Reference`}),_jsxs(Table,{children:[_jsx(_components.thead,{children:_jsxs(_components.tr,{children:[_jsx(_components.th,{children:`Key`}),_jsx(_components.th,{children:`Type`}),_jsx(_components.th,{children:`Required`}),_jsx(_components.th,{children:`Description`})]})}),_jsxs(_components.tbody,{children:[_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`name`})}),_jsx(_components.td,{children:`string`}),_jsx(_components.td,{children:`Yes`}),_jsx(_components.td,{children:`Unique connector identifier referenced by app policies and attribute providers`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`type`})}),_jsx(_components.td,{children:`string`}),_jsx(_components.td,{children:`Yes`}),_jsxs(_components.td,{children:[`Must be `,_jsx(_components.code,{children:`windowsclientauthenticator`})]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`url`})}),_jsx(_components.td,{children:`string`}),_jsx(_components.td,{children:`Yes`}),_jsxs(_components.td,{children:[`URL of the WCA hostname binding on the IIS server (e.g., `,_jsx(_components.code,{children:`https://wca.corp.example.com`}),`)`]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`tls`})}),_jsx(_components.td,{children:`string`}),_jsx(_components.td,{children:`No`}),_jsx(_components.td,{children:`Named TLS profile for communication with the WCA — use when the IIS server has a self-signed or internal CA certificate`})]})]})]}),_jsxs(_components.p,{children:[`For the complete connector field reference, see `,_jsx(_components.a,{href:`/reference/orchestrator/identity-fabric#configuration-reference`,children:`Identity Fabric Configuration Reference`}),`.`]})]})]}),`\n`,_jsx(Heading,{level:`2`,id:`testing`,children:`Testing`}),`\n`,_jsx(_components.p,{children:`To verify the WCA is working correctly:`}),`\n`,_jsxs(_components.ol,{children:[`\n`,_jsxs(_components.li,{children:[`Open a browser and navigate to the WCA URL (e.g., `,_jsx(_components.code,{children:`https://wca.corp.example.com`}),`).`]}),`\n`,_jsx(_components.li,{children:`Enter your Windows credentials when prompted.`}),`\n`,_jsx(_components.li,{children:`The landing page displays the authenticated username, confirming that NTLM authentication is functioning.`}),`\n`]}),`\n`,_jsx(Heading,{level:`2`,id:`ntlm-seamless-authentication`,children:`NTLM Seamless Authentication`}),`\n`,_jsx(_components.p,{children:`By default, browsers prompt users for credentials when accessing the WCA. You can configure browsers to pass Windows credentials automatically for a seamless single sign-on experience.`}),`\n`,_jsx(Heading,{level:`3`,id:`edge-and-chrome`,children:`Edge and Chrome`}),`\n`,_jsxs(_components.p,{children:[`Go to `,_jsx(_components.strong,{children:`Internet Settings`}),` > `,_jsx(_components.strong,{children:`Local Intranet`}),` > `,_jsx(_components.strong,{children:`Advanced`}),`. Under “Add this website to the zone:”, add both the WCA site URL and the application URL.`]}),`\n`,_jsx(Heading,{level:`3`,id:`firefox`,children:`Firefox`}),`\n`,_jsxs(_components.ol,{children:[`\n`,_jsxs(_components.li,{children:[`Navigate to `,_jsx(_components.code,{children:`about:config`}),` in the Firefox address bar.`]}),`\n`,_jsxs(_components.li,{children:[`Add both the WCA site URL and the application URL (comma-separated) to:`,`\n`,_jsxs(_components.ul,{children:[`\n`,_jsx(_components.li,{children:_jsx(_components.code,{children:`network.automatic-ntlm-auth.trusted-uris`})}),`\n`,_jsx(_components.li,{children:_jsx(_components.code,{children:`network.negotiate-auth.delegation-uris`})}),`\n`,_jsx(_components.li,{children:_jsx(_components.code,{children:`network.negotiate-auth.trusted-uris`})}),`\n`]}),`\n`]}),`\n`,_jsxs(_components.li,{children:[`Set `,_jsx(_components.code,{children:`signon.autologin.proxy`}),` to `,_jsx(_components.code,{children:`true`}),`.`]}),`\n`]}),`\n`,_jsx(Heading,{level:`2`,id:`high-availability`,children:`High Availability`}),`\n`,_jsxs(_components.p,{children:[`WCA requires a `,_jsx(_components.strong,{children:`Layer 4 (network) load balancer`}),` for high availability. Do `,_jsx(_components.strong,{children:`not`}),` use a Layer 7 (application) load balancer — Layer 7 load balancers terminate and re-establish TCP connections, which breaks the multi-step NTLM authentication handshake.`]}),`\n`,_jsxs(_components.p,{children:[`Use `,_jsx(_components.strong,{children:`source IP / destination IP / port tuple affinity`}),` (sticky sessions based on client IP) to ensure all packets in an NTLM handshake reach the same backend IIS server.`]}),`\n`,_jsx(Heading,{level:`3`,id:`architecture`,children:`Architecture`}),`\n`,_jsx(_components.p,{children:`The high availability architecture follows this flow:`}),`\n`,_jsxs(_components.p,{children:[_jsx(_components.strong,{children:`Client Machines`}),` → `,_jsx(_components.strong,{children:`App Load Balancer`}),` → `,_jsx(_components.strong,{children:`Orchestrator(s)`}),` → `,_jsx(_components.strong,{children:`Network Load Balancer (Layer 4)`}),` → `,_jsx(_components.strong,{children:`IIS Server(s) with WCA`})]}),`\n`,_jsx(Frame,{caption:`WCA high availability architecture`,children:_jsx(OptimizedImage,{src:`https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-ha-diagram.png?fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=d201f40e19f85566f8ab49d87fd820ad`,alt:`WCA high availability architecture showing client machines connecting through an application load balancer to Orchestrators, which connect through a Layer 4 network load balancer to multiple IIS servers running WCA`,\"data-og-width\":`643`,width:`643`,\"data-og-height\":`202`,height:`202`,\"data-path\":`images/wca-ha-diagram.png`,\"data-optimize\":`true`,\"data-opv\":`3`,srcset:`https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-ha-diagram.png?w=280\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=5f1f6c82607ced81838a0ed1d340d20a 280w, https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-ha-diagram.png?w=560\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=a27d38c2a0945b7d6b807ea6aa784bb8 560w, https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-ha-diagram.png?w=840\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=04449655d8a47919390434148d7b6c15 840w, https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-ha-diagram.png?w=1100\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=4fd35ac12aa66de9ff35e8c402f61341 1100w, https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-ha-diagram.png?w=1650\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=7635b2b0a8038c45ed3c82777b6233cc 1650w, https://mintcdn.com/strataidentity/Irl17n8GnZyYdJvu/images/wca-ha-diagram.png?w=2500\u0026fit=max\u0026auto=format\u0026n=Irl17n8GnZyYdJvu\u0026q=85\u0026s=17d590828f3f290c170aaf80caed991c 2500w`})}),`\n`,_jsx(Warning,{children:_jsx(_components.p,{children:`Using a Layer 7 load balancer in front of WCA servers will cause NTLM authentication failures. NTLM requires an unbroken TCP connection between the client (Orchestrator) and the server (WCA on IIS) across multiple request-response rounds. Layer 7 load balancers proxy at the HTTP level, breaking this connection continuity.`})}),`\n`,_jsx(Heading,{level:`2`,id:`troubleshooting`,children:`Troubleshooting`}),`\n`,_jsxs(AccordionGroup,{children:[_jsxs(Accordion,{title:`NTLM authentication fails through a load balancer`,id:`ntlm-authentication-fails-through-a-load-balancer`,children:[_jsx(_components.p,{children:`NTLM authentication requires an unbroken TCP connection across multiple request-response rounds. Layer 7 (application) load balancers terminate and re-establish connections, breaking the handshake.`}),_jsxs(_components.p,{children:[_jsx(_components.strong,{children:`Fix:`}),` Replace the Layer 7 load balancer with a Layer 4 (network) load balancer. Configure source IP affinity to ensure all packets in a handshake reach the same backend server.`]})]}),_jsxs(Accordion,{title:`Status endpoint returns 401 or 403`,id:`status-endpoint-returns-401-or-403`,children:[_jsxs(_components.p,{children:[`The `,_jsx(_components.code,{children:`/status`}),` endpoint requires Anonymous Authentication to be enabled in IIS. This is a common issue when upgrading from WCA versions prior to v2.x.`]}),_jsxs(_components.p,{children:[_jsx(_components.strong,{children:`Fix:`}),` In IIS Manager, navigate to the WCA application’s Authentication settings and enable `,_jsx(_components.strong,{children:`Anonymous Authentication`}),`.`]})]}),_jsxs(Accordion,{title:`Browser prompts for credentials on intranet`,id:`browser-prompts-for-credentials-on-intranet`,children:[_jsx(_components.p,{children:`By default, browsers do not automatically send Windows credentials to intranet sites. Users will see a credential prompt on each access.`}),_jsxs(_components.p,{children:[_jsx(_components.strong,{children:`Fix:`}),` Configure NTLM seamless authentication in the browser or via Group Policy. See the `,_jsx(_components.a,{href:`#ntlm-seamless-authentication`,children:`NTLM Seamless Authentication`}),` section above.`]})]}),_jsxs(Accordion,{title:`WCA installer fails`,id:`wca-installer-fails`,children:[_jsx(_components.p,{children:`The WCA installer requires the .NET 7.0.13 Windows Server Hosting bundle. If the bundle is not present, the installer will install the bundle for you, but this may fail if there are network or permission issues.`}),_jsxs(_components.p,{children:[_jsx(_components.strong,{children:`Fix:`}),` Manually download and install the `,_jsx(_components.a,{href:`https://dotnet.microsoft.com/en-us/download/dotnet/7.0`,children:`.NET 7 Windows Server Hosting bundle`}),` before running the WCA installer.`]})]})]}),`\n`,_jsx(Heading,{level:`2`,id:`related-pages`,children:`Related Pages`}),`\n`,_jsxs(CardGroup,{cols:2,children:[_jsx(Card,{title:`Identity Fabric`,icon:`id-badge`,href:`/reference/orchestrator/identity-fabric`,children:_jsx(_components.p,{children:`Overview of all identity providers and supported types`})}),_jsx(Card,{title:`Continuity`,icon:`arrows-rotate`,href:`/reference/orchestrator/identity-fabric/continuity`,children:_jsx(_components.p,{children:`IdP failover connector (WCA is not supported by Continuity)`})}),_jsx(Card,{title:`Active Directory`,icon:`folder-tree`,href:`/reference/orchestrator/identity-fabric/activedirectory`,children:_jsx(_components.p,{children:`Active Directory connector — commonly paired with WCA for attribute retrieval`})})]})]})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent};function _missingMdxReference(id,component){throw new Error(`Expected `+(component?`component`:`object`)+\" `\"+id+\"` to be defined: you likely forgot to import, pass, or provide it.\")}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"title":"Microsoft Windows Client Authenticator","icon":"windows","description":null,"href":"/reference/orchestrator/identity-fabric/wca"}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[{"title":"Overview","slug":"overview","depth":2,"children":[]},{"title":"Use Cases","slug":"use-cases","depth":2,"children":[]},{"title":"Requirements","slug":"requirements","depth":2,"children":[]},{"title":"Installation","slug":"installation","depth":2,"children":[]},{"title":"Upgrading from Previous Versions","slug":"upgrading-from-previous-versions","depth":2,"children":[]},{"title":"Status Endpoint","slug":"status-endpoint","depth":2,"children":[]},{"title":"Setup","slug":"setup","depth":2,"children":[]},{"title":"Configuration with Maverics","slug":"configuration-with-maverics","depth":2,"children":[],"tabId":"configuration"},{"title":"Configuration Reference","slug":"configuration-reference","depth":2,"children":[],"tabId":"configuration"},{"title":"Testing","slug":"testing","depth":2,"children":[]},{"title":"NTLM Seamless Authentication","slug":"ntlm-seamless-authentication","depth":2,"children":[{"title":"Edge and Chrome","slug":"edge-and-chrome","depth":3,"children":[]},{"title":"Firefox","slug":"firefox","depth":3,"children":[]}]},{"title":"High Availability","slug":"high-availability","depth":2,"children":[{"title":"Architecture","slug":"architecture","depth":3,"children":[]}]},{"title":"Troubleshooting","slug":"troubleshooting","depth":2,"children":[]},{"title":"Related Pages","slug":"related-pages","depth":2,"children":[]}],"codeExamples":{}},"jsLinks":["/_mintlify/custom/strataidentity/f5eb628399810ff7/status.js","/_mintlify/custom/strataidentity/b8e24dc33885ac0a/cookiebot.js"],"subdomain":"strataidentity","siteName":"Maverics Documentation","title":"Microsoft Windows Client Authenticator - Maverics Documentation","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-09-30T20:34:56.691Z","originalFileLocation":"reference/orchestrator/identity-fabric/wca.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"dark\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"application-name\" content=\"Maverics Documentation\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/strataidentity/qfgJMQlSCT_TH3a0/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/mintlify-assets/_mintlify/favicons/strataidentity/qfgJMQlSCT_TH3a0/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/strataidentity/qfgJMQlSCT_TH3a0/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/strataidentity/qfgJMQlSCT_TH3a0/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/strataidentity/qfgJMQlSCT_TH3a0/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/strataidentity/qfgJMQlSCT_TH3a0/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/strataidentity/qfgJMQlSCT_TH3a0/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/strataidentity/qfgJMQlSCT_TH3a0/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/strataidentity/qfgJMQlSCT_TH3a0/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"Microsoft Windows Client Authenticator - Maverics Documentation\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Maverics Documentation\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://docs.strata.io/reference/orchestrator/identity-fabric/wca\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://strataidentity.mintlify.site/_mintlify/api/og/v2?division=Identity+Fabric\u0026amp;title=Microsoft+Windows+Client+Authenticator\u0026amp;theme=7a495207331bf2ab93b09731\u0026amp;signature=67fb103cf05373ecd48fe226b482c4cf62e230381ad708d985a9aa07a71e8162\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"Microsoft Windows Client Authenticator - Maverics Documentation\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://strataidentity.mintlify.site/_mintlify/api/og/v2?division=Identity+Fabric\u0026amp;title=Microsoft+Windows+Client+Authenticator\u0026amp;theme=7a495207331bf2ab93b09731\u0026amp;signature=67fb103cf05373ecd48fe226b482c4cf62e230381ad708d985a9aa07a71e8162\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/mintlify-assets/_mintlify/favicons/strataidentity/qfgJMQlSCT_TH3a0/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Maverics Documentation\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#1DA1DC\">\u003clink data-mint-head rel=\"canonical\" href=\"https://docs.strata.io/reference/orchestrator/identity-fabric/wca\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/reference/orchestrator/identity-fabric/wca.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://docs.strata.io/#organization\",\"name\":\"Maverics Documentation\",\"url\":\"https://docs.strata.io\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintcdn.com/strataidentity/GnMIwAgmQ7Rnxm8R/logo/light.svg?fit=max\u0026auto=format\u0026n=GnMIwAgmQ7Rnxm8R\u0026q=85\u0026s=f75039b8474c2403c381ef74fdbee428\"}},{\"@type\":\"WebSite\",\"@id\":\"https://docs.strata.io#website\",\"name\":\"Maverics Documentation\",\"url\":\"https://docs.strata.io\",\"publisher\":{\"@id\":\"https://docs.strata.io/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://docs.strata.io/reference/orchestrator/identity-fabric/wca#webpage\",\"url\":\"https://docs.strata.io/reference/orchestrator/identity-fabric/wca\",\"name\":\"Microsoft Windows Client Authenticator\",\"dateModified\":\"2026-09-30T20:34:56.691Z\",\"isPartOf\":{\"@id\":\"https://docs.strata.io#website\"},\"breadcrumb\":{\"@id\":\"https://docs.strata.io/reference/orchestrator/identity-fabric/wca#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://docs.strata.io/reference/orchestrator/identity-fabric/wca#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Orchestration\",\"item\":\"https://docs.strata.io/reference/orchestrator/overview\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Identity Fabric\",\"item\":\"https://docs.strata.io/reference/orchestrator/identity-fabric\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Microsoft Windows Client Authenticator\",\"item\":\"https://docs.strata.io/reference/orchestrator/identity-fabric/wca\"}]},{\"@type\":[\"Article\",\"TechArticle\"],\"@id\":\"https://docs.strata.io/reference/orchestrator/identity-fabric/wca#article\",\"headline\":\"Microsoft Windows Client Authenticator\",\"name\":\"Microsoft Windows Client Authenticator\",\"url\":\"https://docs.strata.io/reference/orchestrator/identity-fabric/wca\",\"mainEntityOfPage\":{\"@id\":\"https://docs.strata.io/reference/orchestrator/identity-fabric/wca#webpage\"},\"dateModified\":\"2026-09-30T20:34:56.691Z\",\"publisher\":{\"@id\":\"https://docs.strata.io/#organization\"},\"isPartOf\":{\"@id\":\"https://docs.strata.io#website\"}}]}\u003c/script>","agentPointerHref":"/reference/orchestrator/identity-fabric/wca.md","siteName":"Maverics Documentation","nav":{"global":null,"tabs":[{"tab":"Introduction","pages":[{"title":"Introduction","href":"/introduction/overview"}]},{"tab":"Guides","pages":[{"title":"Guides","href":"/guides/getting-started/overview"}]},{"tab":"Reference","groups":[{"group":"Console Administration","icon":"browser","pages":[{"title":"Overview","icon":"compass","href":"/reference/console/overview"},{"title":"Single Sign-On (SSO)","icon":"key","href":"/reference/console/sso"},{"title":"User Management","icon":"users","href":"/reference/console/user-management"},{"title":"Audit Logs","icon":"scroll","tag":"Beta","href":"/reference/console/audit-logs"},{"title":"API Clients","icon":"robot","href":"/reference/console/api-clients"},{"group":"Publishing Deployment Configs","icon":"upload","pages":[{"title":"Overview","icon":"upload","href":"/reference/console/config-publishing"},{"title":"Amazon S3 Bucket","icon":"aws","href":"/reference/console/config-publishing/s3"},{"title":"Microsoft Azure Blob Storage","icon":"microsoft","href":"/reference/console/config-publishing/azure-blob"},{"title":"Google Cloud Storage Bucket","icon":"google","href":"/reference/console/config-publishing/gcs"},{"title":"GitHub","icon":"github","href":"/reference/console/config-publishing/github"},{"title":"GitLab","icon":"gitlab","href":"/reference/console/config-publishing/gitlab"}]},{"title":"Break-Glass Procedures","icon":"triangle-exclamation","href":"/reference/console/break-glass"}]},{"group":"Orchestration","icon":"server","pages":[{"title":"Overview","icon":"compass","href":"/reference/orchestrator/overview"},{"group":"Installation","icon":"download","pages":[{"title":"Installation","sidebarTitle":"Overview","icon":"download","href":"/reference/orchestrator/installation"},{"title":"Programmatic Install","icon":"code","href":"/reference/orchestrator/installation/programmatic"},{"title":"Linux","sidebarTitle":"Linux","icon":"linux","href":"/reference/orchestrator/installation/linux"},{"title":"macOS","sidebarTitle":"macOS","icon":"apple","href":"/reference/orchestrator/installation/macos"},{"title":"Windows","sidebarTitle":"Windows","icon":"windows","href":"/reference/orchestrator/installation/windows"},{"title":"Docker","sidebarTitle":"Docker","icon":"docker","href":"/reference/orchestrator/installation/docker"},{"title":"Kubernetes (Helm)","sidebarTitle":"Kubernetes (Helm)","icon":"dharmachakra","href":"/reference/orchestrator/installation/kubernetes"},{"title":"FIPS 140-3 Builds","icon":"shield-check","href":"/reference/orchestrator/installation/fips"}]},{"group":"Configuration","icon":"gear","pages":[{"title":"Configuration","sidebarTitle":"Overview","icon":"gear","href":"/reference/orchestrator/configuration"},{"group":"Config Sources","icon":"folder-open","pages":[{"title":"Config Sources","sidebarTitle":"Overview","icon":"compass","href":"/reference/orchestrator/configuration/config-sources"},{"title":"File","icon":"file","href":"/reference/orchestrator/configuration/config-sources/file"},{"title":"Environment Variable Substitution","icon":"terminal","href":"/reference/orchestrator/configuration/config-sources/environment"},{"title":"Amazon S3","icon":"aws","href":"/reference/orchestrator/configuration/config-sources/s3"},{"title":"Azure Blob Storage","icon":"microsoft","href":"/reference/orchestrator/configuration/config-sources/azure-blob"},{"title":"Google Cloud Storage","icon":"google","href":"/reference/orchestrator/configuration/config-sources/gcs"},{"title":"GitHub","icon":"github","href":"/reference/orchestrator/configuration/config-sources/github"},{"title":"GitLab","icon":"gitlab","href":"/reference/orchestrator/configuration/config-sources/gitlab"}]},{"group":"Secret Providers","icon":"lock","pages":[{"title":"Secret Providers","sidebarTitle":"Overview","icon":"compass","href":"/reference/orchestrator/configuration/secret-providers"},{"title":"AWS Secrets Manager","icon":"cloud","href":"/reference/orchestrator/configuration/secret-providers/aws-secrets-manager"},{"title":"Azure Key Vault","icon":"cloud","href":"/reference/orchestrator/configuration/secret-providers/azure-key-vault"},{"title":"CyberArk Conjur","icon":"lock","href":"/reference/orchestrator/configuration/secret-providers/conjur"},{"title":"CyberArk CCP","icon":"key","href":"/reference/orchestrator/configuration/secret-providers/cyberark-ccp"},{"title":"Delinea Secret Server","icon":"shield-halved","href":"/reference/orchestrator/configuration/secret-providers/delinea"},{"title":"Secret File","icon":"file","href":"/reference/orchestrator/configuration/secret-providers/environment"},{"title":"HashiCorp Vault","icon":"vault","href":"/reference/orchestrator/configuration/secret-providers/hashicorp-vault"}]},{"title":"Field Reference","icon":"table","href":"/reference/orchestrator/configuration/reference"}]},{"group":"Identity Fabric","icon":"users","pages":[{"title":"Identity Fabric","sidebarTitle":"Overview","icon":"compass","href":"/reference/orchestrator/identity-fabric"},{"title":"1Kosmos (SAML)","icon":"id-card","href":"/reference/orchestrator/identity-fabric/onekosmos"},{"title":"Amazon Cognito (OIDC)","icon":"aws","href":"/reference/orchestrator/identity-fabric/cognito"},{"title":"Auth0 (OIDC)","icon":"openid","href":"/reference/orchestrator/identity-fabric/auth0"},{"title":"Continuity","icon":"arrows-rotate","href":"/reference/orchestrator/identity-fabric/continuity"},{"title":"Generic OIDC","icon":"openid","href":"/reference/orchestrator/identity-fabric/custom-oidc"},{"title":"Generic OAuth","icon":"key","href":"/reference/orchestrator/identity-fabric/oauth"},{"title":"Generic SAML","icon":"file-shield","href":"/reference/orchestrator/identity-fabric/custom-saml"},{"title":"CyberArk (OIDC)","icon":"vault","href":"/reference/orchestrator/identity-fabric/cyberark"},{"title":"CyberArk (SAML)","icon":"vault","href":"/reference/orchestrator/identity-fabric/cyberark-saml"},{"title":"Duo (SAML)","icon":"shield-halved","href":"/reference/orchestrator/identity-fabric/duo"},{"title":"Google Workspace (OIDC)","icon":"google","href":"/reference/orchestrator/identity-fabric/google-workspace"},{"title":"HYPR","icon":"fingerprint","href":"/reference/orchestrator/identity-fabric/hypr"},{"title":"Keycloak (OIDC)","icon":"lock-open","href":"/reference/orchestrator/identity-fabric/keycloak"},{"title":"LDAP Authentication","icon":"folder-tree","href":"/reference/orchestrator/identity-fabric/ldap"},{"title":"LDAP Attribute Provider","icon":"folder-tree","href":"/reference/orchestrator/identity-fabric/ldap-attr"},{"title":"Microsoft Active Directory","icon":"microsoft","href":"/reference/orchestrator/identity-fabric/activedirectory"},{"title":"Microsoft ADFS (SAML)","icon":"microsoft","href":"/reference/orchestrator/identity-fabric/adfs"},{"title":"Microsoft Entra ID (OIDC)","icon":"microsoft","href":"/reference/orchestrator/identity-fabric/azure-ad"},{"title":"Microsoft Entra ID (SAML)","icon":"microsoft","href":"/reference/orchestrator/identity-fabric/entra-id-saml"},{"title":"Microsoft Entra ID Attribute Provider","icon":"microsoft","description":null,"href":"/reference/orchestrator/identity-fabric/entra-id-attr"},{"title":"Microsoft Windows Client Authenticator","icon":"windows","href":"/reference/orchestrator/identity-fabric/wca"},{"title":"Okta (OIDC)","icon":"shield-halved","description":null,"href":"/reference/orchestrator/identity-fabric/okta"},{"title":"Okta (SAML)","icon":"shield-halved","href":"/reference/orchestrator/identity-fabric/okta-saml"},{"title":"Okta Attribute Provider","icon":"shield-halved","href":"/reference/orchestrator/identity-fabric/okta-attr"},{"title":"Oracle Identity Cloud Service (OIDC)","icon":"database","href":"/reference/orchestrator/identity-fabric/oracle-ics"},{"title":"Oracle Universal Directory (LDAP)","icon":"database","href":"/reference/orchestrator/identity-fabric/oracle-oud"},{"title":"PingFederate (OIDC)","icon":"circle-dot","href":"/reference/orchestrator/identity-fabric/pingone"},{"title":"PingFederate (SAML)","icon":"circle-dot","href":"/reference/orchestrator/identity-fabric/pingfederate-saml"},{"title":"Trusona (OIDC)","icon":"user-check","href":"/reference/orchestrator/identity-fabric/trusona"},{"title":"WSO2 Identity Server (OIDC)","icon":"globe","href":"/reference/orchestrator/identity-fabric/wso2"}]},{"group":"Modes","icon":"layer-group","pages":[{"title":"AI Identity Gateway","icon":"robot","href":"/reference/modes/ai-identity-gateway"},{"title":"OIDC Provider","icon":"openid","href":"/reference/modes/oidc-provider"},{"title":"SAML Provider","icon":"shield-halved","href":"/reference/modes/saml-provider"},{"title":"HTTP Proxy","icon":"server","href":"/reference/modes/http-proxy"},{"title":"LDAP Provider","icon":"folder-tree","href":"/reference/modes/ldap-provider"}]},{"group":"Applications","icon":"grid-2","pages":[{"title":"Applications","sidebarTitle":"Overview","icon":"grid-2","href":"/reference/orchestrator/applications"},{"title":"Proxy App","icon":"globe","href":"/reference/orchestrator/applications/proxy"},{"title":"OIDC App","icon":"openid","href":"/reference/orchestrator/applications/oidc"},{"title":"SAML App","icon":"shield-halved","href":"/reference/orchestrator/applications/saml"},{"title":"MCP Proxy App","icon":"shuffle","href":"/reference/orchestrator/applications/mcp-proxy"},{"title":"MCP Bridge App","icon":"bridge","href":"/reference/orchestrator/applications/mcp-bridge"}]},{"title":"Authorization","icon":"shield-check","href":"/reference/orchestrator/authorization"},{"group":"Sessions","icon":"id-badge","pages":[{"title":"Sessions","sidebarTitle":"Overview","icon":"id-badge","href":"/reference/orchestrator/sessions"},{"title":"Local Sessions","icon":"microchip","href":"/reference/orchestrator/sessions/local"},{"title":"Logout","icon":"right-from-bracket","href":"/reference/orchestrator/sessions/logout"}]},{"group":"Caches","icon":"bolt","pages":[{"title":"Caches","sidebarTitle":"Overview","icon":"compass","href":"/reference/orchestrator/caches"},{"title":"Redis Cache","icon":"database","href":"/reference/orchestrator/caches/redis"}]},{"group":"Service Extensions","icon":"code","pages":[{"title":"Service Extensions","sidebarTitle":"Overview","icon":"code","href":"/reference/orchestrator/service-extensions"},{"title":"Proxy","icon":"server","href":"/reference/orchestrator/service-extensions/proxy"},{"title":"OIDC","icon":"openid","href":"/reference/orchestrator/service-extensions/oidc"},{"title":"SAML","icon":"building-shield","href":"/reference/orchestrator/service-extensions/saml"},{"title":"LDAP","icon":"folder-tree","href":"/reference/orchestrator/service-extensions/ldap"},{"title":"Session \u0026 Logout","icon":"clock","href":"/reference/orchestrator/service-extensions/session-and-logout"},{"title":"Custom APIs","icon":"plug","href":"/reference/orchestrator/service-extensions/custom-apis"}]},{"title":"Transport Layer Security (TLS)","icon":"shield-halved","href":"/reference/orchestrator/tls-security"},{"group":"Telemetry","icon":"chart-line","pages":[{"title":"Telemetry","sidebarTitle":"Overview","icon":"chart-line","href":"/reference/orchestrator/telemetry"},{"title":"Logging","icon":"file-lines","href":"/reference/orchestrator/telemetry/logging"},{"title":"Metrics","icon":"chart-line","href":"/reference/orchestrator/telemetry/metrics"},{"title":"Traces","icon":"diagram-project","href":"/reference/orchestrator/telemetry/traces"}]},{"group":"Experimental","icon":"flask","pages":[{"title":"Experimental Features","sidebarTitle":"Overview","icon":"flask","href":"/reference/orchestrator/experimental/overview"},{"title":"Client ID Metadata Documents","icon":"id-card","tag":"Experimental","href":"/reference/orchestrator/experimental/client-id-metadata-documents"},{"title":"Token Brokering","icon":"arrow-right-arrow-left","tag":"Experimental","href":"/reference/orchestrator/experimental/token-brokering"}]}]}]},{"tab":"Changelog","pages":[{"title":"Changelog","href":"/changelog"}]}]},"basePath":"","title":"Microsoft Windows Client Authenticator - Maverics Documentation","buildId":"dpl_596ePT575z4qnAFksq1biRW97aLY","deploymentId":"dpl_596ePT575z4qnAFksq1biRW97aLY","dynamics":["07c022d89b","a74be98ba7"],"chunks":["Frame-BXrZabKK.js","DynamicMarkdown-CtasenyM.js","zoom-image-lightbox-C5F0mVLH.js","lightbox-handle-r17bVUz3.js"]}
