Forum Discussion

Javier_124486's avatar
Javier_124486
Icon for Nimbostratus rankNimbostratus
Dec 20, 2017

NTLM fallback path is not been selected

Hello everyone,

 

I've been trying to configure an APM policy to authenticate the users transparently via NTLM as long as the user's computer is Joined to the domain else they should be shown the Logon Page. I've followed the guide from kevin (https://devcentral.f5.com/articles/configuring-apm-client-side-ntlm-authentication) and NTLM works fine (The VS has the irule for NTLM indicated in that post too). The problem comes when the user access with a non-domain joined computer, the browser keep asking for credentials (Pop-up).

 

As per my policy the fallback path for NTLM connects with Logon page, although that Logon Page never comes. If i write down the correct credentials i will not be prompted again for them but the page displays an error (Can’t reach this page) and if used NTLM with a joined computer it will be accepted.

 

Thanks in advanced

 

 

APM
security

7 Replies

Sort By
  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Dec 25, 2017

    Hi,

     

    the issue is client still try to authenticate because of 401 response.

     

    NTLM auth is done before Access policy is evaluated, so it never follow fallback branch.

     

    NTLM auth result is not a NTLM auth action but a validation of NTLM auth performed at LTM level.

     

    try with following code to disable NTLM auth if first attempt fails.

     

    when ECA_REQUEST_DENIED {
   log local0. "User [ECA::username]@[ECA::domainname], Client Machine [ECA::client_machine_name], Auth Status [ECA::status]"
   ECA::disable
}
  • JesseG_357836's avatar
    JesseG_357836
    Icon for Nimbostratus rankNimbostratus
    May 25, 2018

    Hello,

     

    I am struggling with the very same issue. Were you able to resolve it? If so, can you provide a solution?

     

    Thank you

     

    • boneyard's avatar
      boneyard
      Icon for MVP rankMVP
      May 27, 2018

      a first step would be to explain how exactly your situation is the same. how does your policy look? and what of the tips here you already tried.

       

    • JesseG_357836's avatar
      JesseG_357836
      Icon for Nimbostratus rankNimbostratus
      May 29, 2018

      at least from other posts on devcentral, it looks like this may not be possible as NTLM auth happens before the policy starts. So the only workaround is to check for domain membership beforehand, but that requires edge components to be installed and I'm hoping to avoid installing edge components company wide.

       

    • boneyard's avatar
      boneyard
      Icon for MVP rankMVP
      May 30, 2018

      have you read and tried what Stanislas Piron posted? he suggests a method to handle to issue with NTLM happing before the policy.