For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

JustCooLpOOLe's avatar
JustCooLpOOLe
Icon for Cirrocumulus rankCirrocumulus
Jan 19, 2023

My Nightmare - Outlook Anywhere and SSO

Thank you for reading about my nightmare.  I can already feel the love. There has been some chatter centered around offering Outlook Anywhere up to users not on our domain.  However, the chatter is ...
application delivery
Juergen_Mang's avatar
Juergen_Mang
Icon for MVP rankMVP
Jan 20, 2023

If the user does not provide the password in the frontend authentication you can only use kerberos as sso method. This provides a great user experience, look for kerberos constrainted delegation in the apm documentation.

    • boneyard's avatar
      boneyard
      Icon for MVP rankMVP
      Jan 22, 2023

      NTLM auth terminates on the BIG-IP, for the BIG-IP to do Keberos authentication against the Exchange server it requires that Machine Account and to be joined to AD>

      Im not sure this will help you very much though. As you seem to want to add smartcard (client certificate) authentication to NTLM authentication?

      Where is the authentication done now? Directly to Exchange?

      Im not quite sure how the Outlook fat client will handle a sudden certificate request. It seems possible on Exchange itself. But doing that on something in between is different.

      For an idea look at this, but remember that is for a browser, not an Outlook client.

      https://community.f5.com/t5/technical-articles/configuring-smart-card-authentication-and-kerberos-constrained/ta-p/286436

      • JustCooLpOOLe's avatar
        JustCooLpOOLe
        Icon for Cirrocumulus rankCirrocumulus
        Jan 30, 2023

        It doesn't currently exist in the environment.  I just keep getting screenshot of iApp question and answer and no where does it just allow me to user Kerberos.  It always says "NTLM" and only talks about the machine account in addtion to Kerberos.

        The current environment is just using the BIG-IP to proxy traffic to the exchange servers.  I guess my confusion is around the NTLM Machine account.  Is that something created in AD?  And then put on the BIG-IP?