Forum Discussion

raZorTT's avatar
raZorTT
Icon for Cirrostratus rankCirrostratus
Jan 12, 2018

APM - proxy NTLMv1 client side auth to NTLMv2 server side

Hi,

 

I've been asked if the F5 can proxy a request between a client that supports NTLMv1 and a server that currently supports NTLMv2.

 

My understanding of the NTLMv2 SSO Configuration is that it expects the client password to be known, and it uses that in combination with the username and domain to generate the NTLM token to be sent to the server.

 

Can the F5 pull the password out of an NTLM token sent by the client? I had a look at a session dump of an NTLM authenticated client side connection, but couldn't see a session variable for it.

 

I suspect my options are:

 

  1. Set the password using a variable assign in the access profile (client connecting is using a service account so the password doesn't change) but that's not ideal
  2. See if the server can be configured to support Kerberos and then setup a kerberos SSO configuration to authenticate server side

Appreciate any thoughts or suggestions

 

Cheers, Simon

 

1 Reply

  • This is not possible with any product to proxy ntlm auth.

     

    When client authenticate with ntlm on any server, it doesn’t receive the password -—> it can’t authenticate with password on server side.

     

    The server side authentication must be password less like Kerberos sso.