There are a couple of ways to do this. The easiest is to split it into two field extractions that just happen to extract the same field name.
If you are extracting in props.conf, it would look like this:
EXTRACT-e1=(?i) authentication response to (?P<FIELDNAME>\S+)
EXTRACT-e2=(?i) User .* on SCVPN (?P<FIELDNAME>\S+)
Notice that I also simplified your
[^ ]+ to
\S, which means "one or more non-whitespace characters".
(?i) means "case insensitive search" so I don't know if you actually need that either.
If you are extracting using the rex command, you can simply string two rex commands together.
| rex "(?i) authentication response to (?P<FIELDNAME>\S+)"
| rex "(?i) User .* on SCVPN (?P<FIELDNAME>\S+)"
| stats or whatever you want to do here
But if you truly must combine it into one icky regular expression, this should work:
(?i) (?:authentication response to |User .* on SCVPN )(?P<FIELDNAME>[^ ]+)