Welcome to ISAserver.org

ISA Authentication issue

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA 2006 Web Proxy] >> General >> ISA Authentication issue

Page: [1]

Message

<< Older Topic Newer Topic >>

ISA Authentication issue - 17.Jul.2008 1:02:23 PM

ghatoj

Posts: 5
Joined: 17.Jul.2008
Status: offline

Hi,

I have a web filter which listens for the SF_AUTH_COMPLETE notification from ISA server 2006 and executes a function when the notification is received. But for some reason it is executed the first request and then when browser is refreshed the request bypasses the function. After few refreshes the function is executed again, and the problem repeats. Does the ISA server perform authentication at a particular time frame(like every 30 secs)?. It happens with IE but for Firefox works fine. Does the IE keep live connection have an effect?

My ISA server configuration is as follows.

-Two ISA servers for load balancing with a single array, CARP and Web proxy enabled on internal and local machines for both.

-Firewall rules to allow only autheticated client to access the web (HTTP,HTTP Proxy,FTP,HTTPS).
-Clients with firewall client installed.

Thanks in advance

Post #: 1

Featured Links*

RE: ISA Authentication issue - 17.Jul.2008 4:25:10 PM

ferrix

Posts: 363
Joined: 16.Mar.2005
Status: offline

As you have empirically discovered, there is no guarantee that auth complete is called for each request. A single proxy connection will often remain authenticate. If you need to execute something on each connection take a look at the policy check completed event.

(in reply to ghatoj)

Post #: 2

RE: ISA Authentication issue - 17.Jul.2008 5:19:32 PM

ghatoj

Posts: 5
Joined: 17.Jul.2008
Status: offline

This inconsistency is quite an issue. Thanks for the answer by the way. I tried the policy check complete, every thing works fine except I am not getting the username for every request its kind of like preproc headers event now.

(in reply to ferrix)

Post #: 3

RE: ISA Authentication issue - 17.Jul.2008 5:24:40 PM

ferrix

Posts: 363
Joined: 16.Mar.2005
Status: offline

It's not an inconsistency, it's just due to the design of web authentication. You should always be able to get the AUTH_USER value out of GetServerVariable after authentication occurs.

(in reply to ghatoj)

Post #: 4

RE: ISA Authentication issue - 18.Jul.2008 10:10:37 AM

ghatoj

Posts: 5
Joined: 17.Jul.2008
Status: offline

It looks like SF_NOTIFY_PREPROC_HEADERS and SF_NOTIFY_POLICY_CHECK_COMPLETED are the same. Because I register for SF_NOTIFY_PREPROC_HEADERS in GetWPXFilterVersion and check for SF_NOTIFY_POLICY_CHECK_COMPLETED event in HttpWPXFilterProc function and SF_NOTIFY_POLICY_CHECK_COMPLETED gets executed even though I did not register for it.

So even though SF_NOTIFY_POLICY_CHECK_COMPLETED supposed to happen after the authentication is complete according to the MSDN documentation. It practical it is not or I missing out some thing. So the AUTH_USER variable is not set.

The solution seems to be listening for SF_AUTH_COMPLETE which is not sent always.

(in reply to ferrix)

Post #: 5

RE: ISA Authentication issue - 23.Jul.2008 12:39:40 PM

ghatoj

Posts: 5
Joined: 17.Jul.2008
Status: offline

Any ideas please for the above issue?. Can i be able to get all the server variables and perform client redirection after SF_NOTIFY_POLICY_CHECK_COMPLETED is done?. Is it required that I only register 2004 and 2006 specific events such as SF_NOTIFY_POLICY_CHECK_COMPLETED in GetWPXFilterVersion and the rest in GetFilterVersion or it does not matter?

Thanks again

(in reply to ferrix)

Post #: 6

RE: ISA Authentication issue - 24.Jul.2008 5:43:01 PM

Intasar

Posts: 73
Joined: 19.Nov.2007
Status: offline

i have the same issue :(

if u will Select the all users so its working fine on IE and Mozila i m right ? yes i have the same problem .. could please any one solve this issue plz