Return-Path: Delivered-To: apmail-httpd-users-archive@www.apache.org Received: (qmail 44828 invoked from network); 30 Mar 2009 21:57:21 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.3) by minotaur.apache.org with SMTP; 30 Mar 2009 21:57:21 -0000 Received: (qmail 1507 invoked by uid 500); 30 Mar 2009 21:57:18 -0000 Delivered-To: apmail-httpd-users-archive@httpd.apache.org Received: (qmail 1486 invoked by uid 500); 30 Mar 2009 21:57:18 -0000 Mailing-List: contact users-help@httpd.apache.org; run by ezmlm Precedence: bulk Reply-To: users@httpd.apache.org list-help: list-unsubscribe: List-Post: List-Id: Delivered-To: mailing list users@httpd.apache.org Received: (qmail 1477 invoked by uid 99); 30 Mar 2009 21:57:18 -0000 Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 30 Mar 2009 21:57:18 +0000 X-ASF-Spam-Status: No, hits=2.2 required=10.0 tests=HTML_MESSAGE,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (nike.apache.org: domain of lucas.ferreira@gmail.com designates 209.85.217.179 as permitted sender) Received: from [209.85.217.179] (HELO mail-gx0-f179.google.com) (209.85.217.179) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 30 Mar 2009 21:57:10 +0000 Received: by mail-gx0-f179.google.com with SMTP id 27so4971410gxk.0 for ; Mon, 30 Mar 2009 14:56:49 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: <49D13C6A.4070302@ice-sa.com> References: <245770850903301203n389ba5eyb51916a85ee1d351@mail.gmail.com> <49D13C6A.4070302@ice-sa.com> Date: Mon, 30 Mar 2009 18:56:33 -0300 Received: by 10.231.19.204 with SMTP id c12mr1189699ibb.55.1238450208160; Mon, 30 Mar 2009 14:56:48 -0700 (PDT) Message-ID: <245770850903301456h4bec4f8an4d812399d4957f7b@mail.gmail.com> From: Lucas Ferreira To: users@httpd.apache.org, aw@ice-sa.com Content-Type: multipart/alternative; boundary=00221532cf6cbabb2204665d28da X-Virus-Checked: Checked by ClamAV on apache.org Subject: Re: [users@httpd] Apache reverse proxy and IIS integrated authentication --00221532cf6cbabb2204665d28da Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Hello Andr=E9, thanks for the answer. Besides using NTLM, is there any alternative? Would Kerberos work? Thanks, Lucas On Mon, Mar 30, 2009 at 18:40, Andr=E9 Warnier wrote: > Lucas Ferreira wrote: > >> Hello, >> >> I have a Microsoft IIS web server that uses integrated authentication: >> >> WWW-Authenticate: Negotiate >> WWW-Authenticate: NTLM >> >> I would like to setup an Apache-based reverse proxy before this web site= . >> I >> have the proxy configured and working for non-authenticated requests, bu= t >> every request that requires authentication fails with a "401 Unauthorize= d" >> message. If I remove the proxy, the authentication works fine. >> >> So, is it possible to forward integrated authentication using an Apache >> reverse proxy? If yes, where can I find documentation on this? >> >> This may be a problem because NTLM authentication is really > connection-based (I mean not really per-request), and the connection whic= h > the browser has with your proxy, is not the same as the connection which = the > proxy sets up with the back-end server. For example, it would be possibl= e > for the proxy to "pool" several client browser connections, over a single > connection to the back-end server, and that would not allow NTLM to work > properly. > > In a bit more details : NTLM authentication requires multiple exchanges > between the authenticating server and the browser, and these exchanges mu= st > happen in a certain ordered sequence, on the same HTTP connection. > So if two browsers (or even two windows in the same browser) each try to > authenticate to the back-end server, but the proxy multiplexes these > exchanges over a single connection to the back-end server, then from the > back-end (IIS) server point of view, the steps are seen as mixed-up (out = of > sequence on that single connection), and it will not work properly. > > In summary, I think you are doomed, but I am willing to be proven wrong, = as > the subject is of interest to me also. > Another good place to ask may be the jCIFS list at > > jcifs@lists.samba.org > > They are not Apache specialist there, but there are HTTP/NTLM specialists > lurking there. > Just be nice and ask your question in a general sense, not expecting them > to be specifically Apache proxy gurus. > > > > > --------------------------------------------------------------------- > The official User-To-User support forum of the Apache HTTP Server Project= . > See for more info. > To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org > " from the digest: users-digest-unsubscribe@httpd.apache.org > For additional commands, e-mail: users-help@httpd.apache.org > > --=20 If a tree falls in the forest and no one is around to see it, do the other trees make fun of it? --00221532cf6cbabb2204665d28da Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Hello Andr=E9,

thanks for the answer.

Besides using NTLM, is = there any alternative? Would Kerberos work?

Thanks,

Lucas

On Mon, Mar= 30, 2009 at 18:40, Andr=E9 Warnier <aw@ice-sa.com> wrote:
Lucas Ferreira wrote:
Hello,

I have a Microsoft IIS web server that uses integrated authentication:

WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM

I would like to setup an Apache-based reverse proxy before this web site. I=
have the proxy configured and working for non-authenticated requests, but every request that requires authentication fails with a "401 Unauthori= zed"
message. If I remove the proxy, the authentication works fine.

So, is it possible to forward integrated authentication using an Apache
reverse proxy? If yes, where can I find documentation on this?

This may be a problem because NTLM authentication is really connection-base= d (I mean not really per-request), and the connection which the browser has= with your proxy, is not the same as the connection which the proxy sets up= with the back-end server. =A0For example, it would be possible for the pro= xy to "pool" several client browser connections, over a single co= nnection to the back-end server, and that would not allow NTLM to work prop= erly.

In a bit more details : NTLM authentication requires multiple exchanges bet= ween the authenticating server and the browser, and these exchanges must ha= ppen in a certain ordered sequence, on the same HTTP connection.
So if two browsers (or even two windows in the same browser) each try to au= thenticate to the back-end server, but the proxy multiplexes these exchange= s over a single connection to the back-end server, then from the back-end (= IIS) server point of view, the steps are seen as mixed-up (out of sequence = on that single connection), and it will not work properly.

In summary, I think you are doomed, but I am willing to be proven wrong, as= the subject is of interest to me also.
Another good place to ask may be the jCIFS list at =A0 > jcifs@lists.samba.org

They are not Apache specialist there, but there are HTTP/NTLM specialists l= urking there.
Just be nice and ask your question in a general sense, not expecting them t= o be specifically Apache proxy gurus.




---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.<= br> See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
=A0" =A0 from the digest: users-digest-unsubscribe@httpd.apache.o= rg
For additional commands, e-mail: users-help@httpd.apache.org




--
If a tree falls in the = forest and no one is around to see it, do the other trees make fun of it? <= br> --00221532cf6cbabb2204665d28da--