Forum Discussion

cjun's avatar
cjun
Icon for Nimbostratus rankNimbostratus
Jul 17, 2013

hhtp montior for Microsoft NTLM Negoiate

The default HTTP monitor in LTM does not support Micorosft NTLM negotiate, you will always recieve 401 Not Authorized even with username and password provided in the HTTP monitor config. The monitor below is based on the HTTP Monitor curl basic GET under link below:

 

https://devcentral.f5.com/wiki/AdvDesignConfig.HTTPMonitor_cURL_BasicGET.ashx

 

To implement the monitor:

 

- Create a new file containing the code below in /usr/bin/monitors on the LTM filesystem. Permissions on the file must be 700 or better, giving root rwx access to the file. 2. Create a monitor profile of type "External" with the following values:

 

  • External Program: . . the name of the script file created in step above
  • Variables:
    • Name.......Value
    • URI . . . . .the URI to request from the server
    • RECV . . . . the expected response
    • USER . . . . the user name to login
    • PASS . . . . the password for the user

Best regards,

 

CJ

 

 

 

management
monitoring

4 Replies

Sort By
  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Jul 17, 2013
    Very interesting CJ. Thanks for sharing. Also note that as of v11.1, HTTP monitors will fallback to trying NTLM if Basic auth fails.
  • cjun's avatar
    cjun
    Icon for Nimbostratus rankNimbostratus
    Jul 18, 2013
    I tested that in 11.3, the HTTP monitor still not works for NTLM negotiate. In fact, I think this should a RFE, as IIS 7.0 and above seems to be using NTLM negotiate by default.

     

     

    Best regards,

     

    CJ
  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Jul 18, 2013
    The Windows Integrated authentication option in IIS 7 generally comes with Negotiate (Kerberos or NTLM) or just NTLM configured (in that order) as the default, which means it'll accept either Kerberos tickets or NTLM tokens. That can be changed if course.

     

     

    Are you absolutely certain (in 11.3) that you don't see the monitor attempt an NTLM request after failing the Basic auth? You'd see that in a capture.

     

  • cjun's avatar
    cjun
    Icon for Nimbostratus rankNimbostratus
    Jul 25, 2013
    Aah, I have done one more test, the tricky part is HTTP/1.1 must be specified in the send string for this to work. My previous on 11.3.0 did not have HTTP/1.1 in send string, hence it failed. Here is detail monitor config that works fine

     

     

    ltm monitor http /Common/http_iis {

     

    defaults-from /Common/http

     

    destination *:*

     

    interval 5

     

    password welcome123

     

    recv "200 OK"

     

    send "GET / HTTP/1.1\\r\\nUser-Agent: BIG-IP Monitor\\r\\nHost:10.168.10.105\\r\\nAccept: */*"

     

    time-until-up 0

     

    timeout 16

     

    username bigip

     

    }

     

     

    Best regards,

     

    CJ