Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

Web proxy Authentication prompt needed

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA Server 2004 Cache] >> Web Proxy client >> Web proxy Authentication prompt needed Page: [1]
Login
Message << Older Topic   Newer Topic >>
Web proxy Authentication prompt needed - 29.Mar.2005 3:47:00 PM   
jerumball

 

Posts: 52
Joined: 7.May2004
From: Sudbury, ON Canada
Status: offline
I am about to rollout the ISA 2004 EE Web Proxy Client functionality to 1500 desktops in our enterprise but I am having a small authentication problem.

Web client authentication is set to integrated as we have a new AD Domain to which all our users belong. Generally speaking, my firewall policies allow http access to the Internet if the logged on user is a member of the Internet domain group... and no authentication prompt is given to the user. This works fine.

However, we have a need to prompt users for their credentials when they try to surf while they are logged on with one of our generic accounts. In our existing ISA 2000 environment, this works fine, but I cannot figure out how to get this to work under ISA 2004 EE.

Any thoughts or suggestions would be most appreciated.

Regards,

John

[ March 29, 2005, 04:06 PM: Message edited by: jerumball ]
Post #: 1
RE: Web proxy Authentication prompt needed - 30.Mar.2005 12:54:00 PM   
tshinder

 

Posts: 47439
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi John,

Make sure you are supporting both integrated and basic auth on the Web listener.

HTH,
Tom

(in reply to jerumball)
Post #: 2
RE: Web proxy Authentication prompt needed - 30.Mar.2005 3:52:00 PM   
jerumball

 

Posts: 52
Joined: 7.May2004
From: Sudbury, ON Canada
Status: offline
Thanks for your reply, Tom. I modified the authentication methods for the web proxy listener for my "Internal" network, and tested this again. Unfortunately, I got the same results... the generic user is flat-out denied access to the sample web site and redirected to a custom "Denied" page I had built, instead of getting prompted to enter domain credentials.

The firewall policy that controls this behaviour is the very last one, immediately before the Enterprise default rule.

Can you think of anything else I should try?

Thanks, as always, for your help.

John

[ March 30, 2005, 03:57 PM: Message edited by: jerumball ]

(in reply to jerumball)
Post #: 3
RE: Web proxy Authentication prompt needed - 18.Apr.2005 9:58:00 PM   
jerumball

 

Posts: 52
Joined: 7.May2004
From: Sudbury, ON Canada
Status: offline
I am still having problems getting this to work as it did under ISA 2000. If anyone has any auggestions, I'd love to hear it! I am down to the wire now, so any help would be appreciated!

Thanks.

John

(in reply to jerumball)
Post #: 4
RE: Web proxy Authentication prompt needed - 19.Apr.2005 2:11:00 PM   
ClintD

 

Posts: 1833
Joined: 26.Jan.2001
From: Keller, TX
Status: offline
This is called ReturnAuthRequiredIfAuthUserDenied in ISA 2004 and can be set with this script.

Link : From MSDN, look on the left, under FpcWeblistenerProperties, for the value ReturnAuthRequiredIfAuthUserDenied

code:
Sub SetNetworkReturnAuthReq(newValue)

' Define the constant needed.
Const fpcInternalNetwork = 4

' Declare the other objects needed.
Dim root ' The FPCLib.FPC root object
Dim isaArray ' An FPCArray object
Dim networks ' An FPCNetworks collection
Dim network ' An FPCNetwork object
Dim currentValue ' A Boolean

' Create the root object.
Set root = CreateObject("FPC.Root")

' Get references to the array object
' and the networks collection.
Set isaArray = root.GetContainingArray()
Set networks = isaArray.NetworkConfiguration.Networks

' Set the property for the Internal network if necessary.
For Each network In networks
If network.NetworkType = fpcInternalNetwork Then
currentValue = network.WebListenerProperties.ReturnAuthRequiredIfAuthUserDenied
WScript.Echo "Current value: " & currentValue
If newValue <> currentValue Then
network.WebListenerProperties.ReturnAuthRequiredIfAuthUserDenied = newValue
WScript.Echo "New value: " & network.WebListenerProperties.ReturnAuthRequiredIfAuthUserDenied
network.Save
End If
End If
Next
End Sub



[ April 19, 2005, 02:13 PM: Message edited by: ClintD ]

(in reply to jerumball)
Post #: 5
RE: Web proxy Authentication prompt needed - 19.Apr.2005 3:29:00 PM   
jerumball

 

Posts: 52
Joined: 7.May2004
From: Sudbury, ON Canada
Status: offline
Hi CLintD,

Thanks very much for pointing me at this script. This looks like it's exaclty what I need. I do have two questions, however...

1. How do I go about running this script? I have never done this before.

2. Do I run this script on both of my array servers, or is it only required on one since the ISA configs automatically propogate to array members?

Thanks again.

John

(in reply to jerumball)
Post #: 6
RE: Web proxy Authentication prompt needed - 19.Apr.2005 7:10:00 PM   
ClintD

 

Posts: 1833
Joined: 26.Jan.2001
From: Keller, TX
Status: offline
As for the script, just copy the text above into notepad and save it with a VBS extension. Then, just double-click on the VBS file. You won't get any response that it's completed - it's a very basic script.

As for where to run it, you can run it on either node of the array - the script will set the attribute on the Config Storage Server and the other node will pull it down once it refreshes it's config.

(in reply to jerumball)
Post #: 7
RE: Web proxy Authentication prompt needed - 19.Apr.2005 9:08:00 PM   
jerumball

 

Posts: 52
Joined: 7.May2004
From: Sudbury, ON Canada
Status: offline
Hi again Clint,

That script did exactly what I was hoping for! Thanks.

However, I have noticed that now when I get prompted, it happens twice... once for each array member. Is this normal behaviour? Is there anyway to have the credentials passed to second array member automatically?

Regards,

John

(in reply to jerumball)
Post #: 8
RE: Web proxy Authentication prompt needed - 19.Apr.2005 10:15:00 PM   
ClintD

 

Posts: 1833
Joined: 26.Jan.2001
From: Keller, TX
Status: offline
That's...ummm...interesting. [Big Grin]

Are you resolving the ISA array through a CNAME that maps to 2 different IP addresses or to a virtual IP?

The reason I ask is that I think Internet Explorer is setting up 2 TCP sessions (1 for each array node) and that's why you see 2 prompts - each TCP session is unique and the credentials aren't passed automatically with the config change we made - we only auto-supply credentials on the first challenge.

I'm just guessing though - I don't have an ISA server in front of me right now to test.

(in reply to jerumball)
Post #: 9
RE: Web proxy Authentication prompt needed - 20.Apr.2005 2:31:00 PM   
jerumball

 

Posts: 52
Joined: 7.May2004
From: Sudbury, ON Canada
Status: offline
I am resolving the ISA array to the virtual IP created on the internal network.

As an example, when I first open IE and then browse to www.google.ca, I get a logon prompt from the first of my two ISA servers (the IP is displayed at the top of the dialog). I am then allowed to use Google for searches, etc. If I click on one of the hyperlinks in the search results, I get another prompt (for some links, not all) but this time from my 2nd ISA server. I guess it is load balancing at this point.

Before I roll this new ISA array out to my 5000 users I would like to see if I can change this behaviour, or else I'm sure our HelpDesk will get bombarded with calls.

Thanks very much.

John

(in reply to jerumball)
Post #: 10
RE: Web proxy Authentication prompt needed - 20.Apr.2005 11:17:00 PM   
ClintD

 

Posts: 1833
Joined: 26.Jan.2001
From: Keller, TX
Status: offline
Did you also enable CARP? It sounds like it from the behavior you describe. Can you disable it if so and see if the scenario changes?

(in reply to jerumball)
Post #: 11
RE: Web proxy Authentication prompt needed - 19.May2005 3:28:00 PM   
jerumball

 

Posts: 52
Joined: 7.May2004
From: Sudbury, ON Canada
Status: offline
Yes, CARP is enabled.

I could try to disable it, but I am not sure what the overall implications of disabling it would be!? Would all my cached content be stored on only one of my array members? If so, does that then mean this content would not be available to web proxy clients who happen to be using the other array member? Or would there be two individual and spearate caches stores, one on each array member?

Thanks in advance.

John

(in reply to jerumball)
Post #: 12
RE: Web proxy Authentication prompt needed - 19.May2005 4:16:00 PM   
ClintD

 

Posts: 1833
Joined: 26.Jan.2001
From: Keller, TX
Status: offline
Yeah - this is going to be a problem with that attribute we set - the ISA Server is just what we've told it to do, but the problem is that with CARP, the client will send the request to the other node for a range of websites (tbis is how the CARP algorithm works).

Unfortunately, the other ISA Server doesn't know about the previous request and the user gets prompted.

(in reply to jerumball)
Post #: 13
RE: Web proxy Authentication prompt needed - 16.Jun.2005 10:43:00 AM   
jenlee64

 

Posts: 3
Joined: 1.Jun.2005
From: Lafayette, LA
Status: offline
Hi All,

Questions I have on this script. We are looking to do the same thing. But, have a mix of client os's. Some XP, 2000 and 98.

I see that Microsoft claims requirements are for XP clients only. Can this script work for 2000 and 98 clients as well?

Also, how would you back out of this script if you ran it and it does not work for you?

Thanks -- Jenlee64

(in reply to jerumball)
Post #: 14
RE: Web proxy Authentication prompt needed - 27.Jul.2005 3:37:00 PM   
Guest
Hi all,

I've been reading a lot and trying a lot, to get the exact opposite of what the threadstarter wanted. When a user is not allowed internet access through the proxy, I just want ISA to redirect them to my custom "access denied page" WITHOUT prompting for credentials.

I have tried a lot of things, also the script, but I can't get it to work. Authenticated users work like a charm (integrated authentication with IE), but when a user is not a member of the "Inet access users", then they get a message prompting them for correct credentials.

I HAVE to get rid of this prompt, or I cannot publish ISA to my users

Please help me ...

Thanks in advance,

Thanis

(in reply to jerumball)
  Post #: 15

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [ISA Server 2004 Cache] >> Web Proxy client >> Web proxy Authentication prompt needed Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts