vsa and authenticate-only service-type