My Nightmare - Outlook Anywhere and SSO

Question

Thank you for reading about my nightmare. I can already feel the love.

There has been some chatter centered around offering Outlook Anywhere up to users not on our domain. However, the chatter is more centered around the BIG-IP performing some SSO in the process so that Outlook Anywhere users can be prompted for their Smart Card credentials and then those credentials are passed back to the Exchange Server. Outlook Anywhere is configured to use NTLM.

Has anyone been successful or even a little insane to try this out? I am familiar with the on-demand cert auth and grabbing the certification info but the SSO piece, I have not had the pleasure of attempting.

Any advice is appreciated!

juergen_mang · Answer

If the user does not provide the password in the frontend authentication you can only use kerberos as sso method. This provides a great user experience, look for kerberos constrainted delegation in the apm documentation.

boneyard · Answer

NTLM auth terminates on the BIG-IP, for the BIG-IP to do Keberos authentication against the Exchange server it requires that Machine Account and to be joined to AD&gt;
Im not sure this will help you very much though. As you seem to want to add smartcard (client certificate) authentication to NTLM authentication?
Where is the authentication done now? Directly to Exchange?
Im not quite sure how the Outlook fat client will handle a sudden certificate request. It seems possible on Exchange itself. But doing that on something in between is different.
For an idea look at this, but remember that is for a browser, not an Outlook client.
https://community.f5.com/t5/technical-articles/configuring-smart-card-authentication-and-kerberos-constrained/ta-p/286436

boneyard · Answer

Which explains a good part of it I believe.
To do NTLM authentication on the BIG-IP you need to have it domain joined. That is just a requirement, similar for other products that want to allow NTLM authentication from clients, like a web proxy, see:
https://help.endian.com/hc/it/articles/218144628-Web-Proxy-Authentication-NTLM-
Now we can join the domain by providing a Domain Administrative user name and password (one with permissions to perform domain joins).
BTW: I said earlier you require the machine account for the Kerberos authentication, that is my bad, but NOT the case. You need the machine account to do the NTLM authentication.

justcoolpoole · Answer

Thanks&nbsp;Juergen_Mang&nbsp;We're reviewing the following document that describes what we're looking for but I'm not really following the "Machine Account" piece.&nbsp; Do you or anyone know what that is?&nbsp; Purpose?https://techdocs.f5.com/en-us/bigip-16-1-0/big-ip-access-policy-manager-authentication-methods/ntlm-authentication-for-microsoft-exchange-clients.html&nbsp;

justcoolpoole · Answer

It doesn't currently exist in the environment.&nbsp; I just keep getting screenshot of iApp question and answer and no where does it just allow me to user Kerberos.&nbsp; It always says "NTLM" and only talks about the machine account in addtion to Kerberos.The current environment is just using the BIG-IP to proxy traffic to the exchange servers.&nbsp; I guess my confusion is around the NTLM Machine account.&nbsp; Is that something created in AD?&nbsp; And then put on the BIG-IP?

Forum Discussion

My Nightmare - Outlook Anywhere and SSO

7 Replies

Recent Discussions

import live updates from version x to version y

Tenant image upgrade

iRule editor partition button does not work

F5Access | MacOS Sonoma

Overwriting or adding LTM SSL Traffic cert and key using iControlREST

Related Content

Making EKS Anywhere Highly Available and Secure

Outlook Anywhere Persistence with Cookie Backup

How to Automate Load Balancing ECS Anywhere

Outlook NTL Authentication

Available Applications Anywhere