For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

kracti's avatar
kracti
Icon for Nimbostratus rankNimbostratus
Jun 22, 2023

Authentication Failed with NTLMv2

Hello everyone,  I am trying to activate a MFA with SAML for authentication in an external domain and then through NTLMv2 and SSO I want to authenticate against a web application but it ends up givi...
security
whisperer's avatar
whisperer
Icon for MVP rankMVP
Jun 22, 2023

Please take a look at the following for starters:

https://community.f5.com/t5/technical-articles/configuring-apm-client-side-ntlm-authentication/ta-p/286460

Make sure DNS is properly configure on F5 in addition to NTP for things to work properly.

Please provide some output of /var/log/apm while testing this configuration for tshoot assistance. Need help with this? Check out the following:

https://f5-agility-labs-iam.readthedocs.io/en/latest/class8/module5/module5.html

 

 

kracti's avatar
kracti
Icon for Nimbostratus rankNimbostratus
Jun 22, 2023

Thank you a lot, whisperer!

Kevin's article on NTLM was already known to me and I have read it but the second F5 article is very interesting and extensive; i'll keep an eye on it, of course. Currently We already have an SSO working in production, both the NTP and DNS parts are correctly configured. On the other hand, this is the message that is constantly repeated when you try to finish the NTLM+Kerberos authentication with SSO against the final web application (the username, hostname and domain information has been modified for security & privacy reasons, obviously). Also comment that a small code is executed in TCL (from the Access Policy) to delete the external domain and automatically add the SSO to the configured internal domain against which you really have to authenticate. Also, the 1st authentication with SAML works correctly:

Jun 22 23:17:30 bigip1.domain.external.com warning apmd[6039]: 01490106:4: /Common/SAML_Proof:Common:8a5b93e6: AD module: authentication with 'username' failed: Preauthentication failed, principal name: username@domain.internal.com. Invalid user credentials. (-1765328360)

Thanks!