For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Javier_124486's avatar
Javier_124486
Icon for Nimbostratus rankNimbostratus
Dec 20, 2017

NTLM fallback path is not been selected

Hello everyone,   I've been trying to configure an APM policy to authenticate the users transparently via NTLM as long as the user's computer is Joined to the domain else they should be shown the ...
BIG-IP Access Policy Manager (APM)
security
JesseG_357836's avatar
JesseG_357836
Icon for Nimbostratus rankNimbostratus
May 25, 2018

Hello,

 

I am struggling with the very same issue. Were you able to resolve it? If so, can you provide a solution?

 

Thank you

 

  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    May 27, 2018

    a first step would be to explain how exactly your situation is the same. how does your policy look? and what of the tips here you already tried.

     

  • JesseG_357836's avatar
    JesseG_357836
    Icon for Nimbostratus rankNimbostratus
    May 29, 2018

    at least from other posts on devcentral, it looks like this may not be possible as NTLM auth happens before the policy starts. So the only workaround is to check for domain membership beforehand, but that requires edge components to be installed and I'm hoping to avoid installing edge components company wide.

     

  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    May 30, 2018

    have you read and tried what Stanislas Piron posted? he suggests a method to handle to issue with NTLM happing before the policy.

     

  • JesseG_357836's avatar
    JesseG_357836
    Icon for Nimbostratus rankNimbostratus
    May 30, 2018

    tried it. it does not work. ECA_REQUEST_DENIED would be triggered after NTLM attempt was made. That's already after the browser prompts for a username/password