Forum Discussion
NimbostratusNTLM advice please
We're planning on hosting HP TRIM server for some clients on a separate domain. My understanding is the client software uses NTLM to pass credentials to the server and this is the only authentication mechanism available. I'm wondering if there is some way of mapping credentials from one domain to another domain via the F5 LTM with APM or some crazy techno-magic similar to that?
One possibility I'm envisaging:
-
Client starts an APM session with a set of credentials on our domain
-
TRIM client then permitted to connect to TRIM virtual server hosted on the F5
-
When F5 receives TRIM client traffic, it confirms that client traffic is part of the previously established APM session somehow and nukes whatever NTLM stuff is in said traffic replacing it with NTLM stuff based on cached credentials for the session so that our TRIM server receives the APM credentials instead
Is that how it would have to work? Is that even possible?
2 Replies
- Kevin_Stewart
Employee
I think that's a reasonable solution. Allow me to elaborate:
-
Your (browser?) client initiates an APM session and passes (explicit?) logon credentials. Those credentials are potentially vetted and then stored in the session.
-
The TRIM client starts and passes NTLM credentials. We know, by virtue of some mechanism that hasn't been discussed yet, that the TRIM client is on the same host that has an active web-based session.
-
APM strips the TRIM client's NTLM header (is it an HTTP-based client?) and applies an NTLM SSO to the server side dialog using the cached credentials from the explicit web-based logon.
Does that sound about right? If so, the following questions remain:
-
Is the TRIM client web-based? Such that the NTLM data is in an Authorization header in an HTTP request?
-
What can you use to correlate the web client to the TRIM client? Will the TRIM client consume and use cookies? Does the web client launch the TRIM client with a special URL?
-
Sam_HallI discovered HP TRIM client/server traffic uses RCF (Remote Call Framework) over TCP port 1137 for TRIM client traffic, this is encapsulated within NTLM or Kerberos which provides both the authentication mechanism as well as some level of encryption. There are no alternative authentication options available.
HP recommends deploying a "Workgroup Server" on each site and then have a central database. That's not ideal in this situation as we were hoping to offer the service from entirely within our own infrastructure.
Another viable option would be to ask that the clients firstly establish a VPN connection, but then we would still have to overcome the issue of mapping user credentials which goes away if we have them host the TRIM Workgroup Server on their own domain. I guess we could trust the VPN allocated IP address at that stage and attempt to offload NTLM or something, though I'm not sure it's worth the effort. We'll probably present them with the options of setting up cross domain trust vs. hosting their own TRIM Workgroup Server.
