I have set up a virtual server with only one server behind it. It is a simple HTTP connection, however when I try to access the application, I am prompted to enter my userid and password. When accessing the application directly on the server this is not the case. To make things even worse, I have now discovered that some users are not prompted when accessing via the F5 while others still are. No one is prompted when not passing thru the F5.

Are you performing source address translation on the BIG-IP? If so, the client IP address that the web server sees would change. Does the web server request credentials form the client through the BIG-IP because the IP address isn't what it's expecting? Else, perhaps multiple client HTTP requests are being sent over the same TCP connections using OneConnect. What kind of authentication is the server performing? What do you see in the server logs when the issue occurs? Aaron

Aaron To answer your questions, yes SNAT is enabled, it is using windows authentication, multiple requests is not an issue, this is in a test setup for now and it is a very small group doing the testing, also OneConnect is not enabled for this server, and yes all the traffic is passing thru the BIG-IP.

It's very odd that only some users are prompted for a password through the BIG-IP. Is it possible that some users already entered a password and their browser is caching it? Do you see in the server logs that the users which don't get prompted have an authorization header with a user/pass (or NTLM token) set? Are you able to change the default gateway of the test server to the BIG-IP's self IP and disable SNAT? If so, do some users still get prompted for a password? Aaron

We are not able to change the server, here is the interesting part of all of this, I have dumped the interfaces, when it works, the client gets back a ""401 not authorized" and then sends a NTLMSSP_Negotiate, when it fails the client sees the "401 not authorized" but it does not send the NTLMSSP_Negotiate, now for the real interesting part. from the same client, with no changes, if I try to hit the server by the IP of the virtual server in the BIG-IP it fails, however if I set up a DNS entry for the IP of the virtual server and hit the server by name, it works every time and so far from every machine.

When clients make a request directly to the server by IP address, do they get the same results as when they access the VIP by IP address? I'm not familiar enough with NTLM to know why it would make a difference whether the client makes a request by IP or port. Does anyone else have ideas? Else, this page has a good quick summary of the NTLM: NTLM Authentication Scheme for HTTP http://davenport.sourceforge.net/ntlm.html Aaron

Prompting for passwords

13 Replies

naladar_65658
Altostratus
Jul 21, 2009
With the setup the way you describe you might try putting the site in question into the "LOCAL INTRANET" zone inside of IE (NOT the trusted sites list!!!) on the computers you are using to access the site with. We were having some issues and that solved our problem. Test that on a few computers and if it works then blast it out with a GPO setting or use a WMI script to append those entries.

Example: If you the website you are accessing is called https://mysite.mydomain.com , put something like *.mydomain.com into the local intranet zone list. Just for testing purposes, you can be more descriptive later if that solves the problem.
jasonpsmith_408
Nimbostratus
Jul 23, 2009
i have 2 vips now that i mirrored the configs.

then i change one to remove the OneConnect

the other i Added Cookie Persistency.

what i saw was the 1 VIP i Added Persistency seems to be working better (i am not going to say "Fixed" yet)

the strange thing is the 1 VIP i removed OneConnect from, the Round Robin has stopped and acks as it has Persistency on.

not sure if that is relevant. i am ignoring that result for now.
hooleylist
Cirrostratus
Jul 23, 2009
If you remove OneConnect and disable a pool member do you ever get a password prompt? This scenario will eliminate persistence failures as one possible cause of a problem.

Aaron

Forum Discussion

Prompting for passwords

13 Replies

Recent Discussions

sysHttpStatRespBucket1k SNMP metrics meaning

Maximum throughput of f5 ltm

F5 not sending traffic to Web pool

Inquiry on F5's Maintenance Mode Feature for Pool Members

BIG-IP Next

Related Content

Automate scp transfers using password

Password Safety & Security: Passwords vs. Passphrases

Ansible module to update BIG-IP root/admin passwords

Pwned Passwords Check

F5 APM with OIDC Web Duo Prompt