Forum Discussion
NimbostratusNTLM fallback path is not been selected
Hello everyone,
I've been trying to configure an APM policy to authenticate the users transparently via NTLM as long as the user's computer is Joined to the domain else they should be shown the Logon Page. I've followed the guide from kevin (https://devcentral.f5.com/articles/configuring-apm-client-side-ntlm-authentication) and NTLM works fine (The VS has the irule for NTLM indicated in that post too). The problem comes when the user access with a non-domain joined computer, the browser keep asking for credentials (Pop-up).
As per my policy the fallback path for NTLM connects with Logon page, although that Logon Page never comes. If i write down the correct credentials i will not be prompted again for them but the page displays an error (Can’t reach this page) and if used NTLM with a joined computer it will be accepted.
Thanks in advanced
- boneyard
MVP
you could see if it works with kerberos, there is some discussion about that here and i have seen this working: https://devcentral.f5.com/questions/kerberos-401-authentication-with-form-fallback
afterwards you could go back to NTLM and see if that works.
this is a little bit more what you want, but they use different selections to go for NTLM or forms
https://devcentral.f5.com/articles/leveraging-big-ip-apm-for-seamless-client-ntlm-authentication
Stanislas_Piro2Cumulonimbus
Hi,
the issue is client still try to authenticate because of 401 response.
NTLM auth is done before Access policy is evaluated, so it never follow fallback branch.
NTLM auth result is not a NTLM auth action but a validation of NTLM auth performed at LTM level.try with following code to disable NTLM auth if first attempt fails.
when ECA_REQUEST_DENIED { log local0. "User [ECA::username]@[ECA::domainname], Client Machine [ECA::client_machine_name], Auth Status [ECA::status]" ECA::disable }
JesseG_357836Hello,
I am struggling with the very same issue. Were you able to resolve it? If so, can you provide a solution?
Thank you
- boneyard
a first step would be to explain how exactly your situation is the same. how does your policy look? and what of the tips here you already tried.
- JesseG_357836
at least from other posts on devcentral, it looks like this may not be possible as NTLM auth happens before the policy starts. So the only workaround is to check for domain membership beforehand, but that requires edge components to be installed and I'm hoping to avoid installing edge components company wide.
- boneyard
have you read and tried what Stanislas Piron posted? he suggests a method to handle to issue with NTLM happing before the policy.
