For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Martin_Robbins's avatar
Martin_Robbins
Icon for Nimbostratus rankNimbostratus
Apr 03, 2014

APM WebSSO NTLM not supporting unicode characters in passwords

Hello,

 

Has anyone found a way around the issue that a password containing unicode characters (a-umlaut, u-umlaut, etc.) is garbled and thus rejected when using NTLM WebSSO authentication in APM by back end Windows servers?

 

Front end authentication with a VPE containing AD Query and AD Auth work fine, just the backed SSO is broken with NTLM.

 

There is an RFE for it, 398134 but I can only assume that not many non-US users have not had many issues with it as it has not been fixed and is "merely" a request for enhancement ...

 

All of our users have either a German, French or Italian keyboard thus it is quite normal to have an ü, ö or ä in there passwords. This is causing our help desk serious headaches resetting their passwords.

 

thanks.

 

BIG-IP Access Policy Manager (APM)
deployment
microsoft
security
TMOS

4 Replies

  • Stefan_Klotz's avatar
    Stefan_Klotz
    Icon for Cumulonimbus rankCumulonimbus
    Jun 29, 2015

    Hi there,

     

    this topic is quite some days old, but seems to match my issue as well. So I assume it might be the same root cause.

     

    I'm also using a APM policy with SSO, but "only" with HTTP basic. A users password contains the character "§" and the F5 parses this incorrectly to the backend server (resulting in a 401). I sniffered the traffic both with SSO enabled and without.

     

    Without SSO this character will be displayed as "\247" in Wireshark.

     

    With SSO this character will be displayed as "\302\247" in Wireshark.

     

    Any idea how this can be fixed within APM?

     

    Thank you!

     

    Ciao Stefan :)

     

  • Rene_C_'s avatar
    Rene_C_
    Icon for Nimbostratus rankNimbostratus
    May 31, 2016

    So, now i have a similar issue. I am parsing the Basic Auth Header from the Request inside an iRule and set it into a session variable for APM -> special characters are now garbage.

     

    Would also like to see a solution to this.

     

    Cheers, Rene

     

  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Apr 13, 2019

    i would advise you to open a support ticket for this and please report back on the response and possible bug ID.