Welcome to ISAserver.org

Client may delegate directly - Basic > NTLM

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA 2006 Publishing] >> Web Publishing >> Client may delegate directly - Basic > NTLM

Page: [1]

Message

<< Older Topic Newer Topic >>

Client may delegate directly - Basic > NTLM - 11.Jan.2008 12:03:43 PM

sammannix

Posts: 9
Joined: 18.Dec.2006
Status: offline

Hello,

I have a web listener which uses Basic Authentication. When publishing to a website which requires integrated authentication, and the delegation option set on the firewall rule to ...but client may authenticate directly, but rule is still denied even when inputting correct credentials. I found through a trace it seems ISA is trying to authenticate to the website using Basic instead of NTLM.

The ISA server can't be a member of a domain, so Integrated can not be used on the listener.

Is this feasibly not possible?

Thank you

Sam

Post #: 1

Featured Links*

RE: Client may delegate directly - Basic > NTLM - 29.Jan.2008 6:53:57 AM

tshinder

Posts: 47663
Joined: 10.Jan.2001
From: Texas
Status: offline

Join the ISA Firewall to the domain to get the NTLM functionality and increase security. It's a very poor security decision to not join the ISA Firewall to the domain. You might want to warm whoever made that decision that it's not the best security configuration and they should revisit their security design documents.

HTH,
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to sammannix)

Post #: 2