Skip to main content
moby
moby
New Member
January 22, 2019
Question

Explicit Proxy and NTLM

  • January 22, 2019
  • 2 replies
  • 21363 views

Hi All,

 

I have a scenario where I need to use the Explicit proxy and NTLM authentication. We are replacing another web proxy solution that is currently doing this. The authentication needs to be transparent and current is, so the browsers are configured to provide authentication responses already.

 

We are currently using FortiOS 5.4.

 

I have read some posts which seem to suggest that we require Fortigate/LDAP and FSSO  - -but i am confused as to why we would need an FSSO collector in this setup.

 

Would the explicit proxy not just challenge the user browser and then based on the username returned perform an LDAP query to get the user/group membership details and then check the proxy policies?

 

Is an FSSO collector required in this setup and if so why?

 

Thanks, Moby.

    2 replies

    emnoc
    emnoc
    New Member
    January 22, 2019

    I think FSSO just make this  much easier  but I'm curious as to what you come up with? I believe www ntlm is supported now and in explicit proxy, I would love to see it working. We have the same requirement btw

     

    Ken Felix

    James_G
    James_G
    New Member
    January 22, 2019
    Hi, I configured an explicit proxy with ntlm auth today, works really well. I have 6.0.4 on the unit I was testing this with, any chance you are going to upgrade? The reason I went for ntlm was I'm using a citrix environment and fsso dc polling cannot identify users without extra agent software on hosts, I would rather no agent.
    James_G
    James_G
    New Member
    January 23, 2019

    Some config if it helps:

     

    config user ldap edit "DC01" set server "10.10.10.10" set cnid "cn" set dn "dc=domain,dc=local" set type regular set username "domain\\user" set password ENC xxxxxxxxxxxxxxxxxxxx set port 3268 next end

    config user domain-controller edit "domain.local" set ip-address 10.10.10.10 set domain-name "domain.local" set ldap-server "DC01" next end

    config user group edit "SSO_Guest_Users" next edit "All Staff" set member "DC01" config match edit 1 set server-name "DC01" set group-name "CN=Domain Users,CN=Users,DC=domain,DC=local" next end next end

    config authentication scheme edit "domain.local" set method ntlm set domain-controller "domain.local" next end

    config authentication rule edit "domain.local" set srcaddr "all" set ip-based disable set active-auth-method "domain.local" set web-auth-cookie enable next end

    moby
    mobyAuthor
    New Member
    January 23, 2019

    Hi,

     

    Thanks for the responses. James, do you have any FSSO polling at all? or are you just using the LDAP and domain controller configuration as you have shown?

     

    I will see if I can get it working on 5.4.10 but if not then will upgrade to 6.0.4

     

    Thanks, Moby.

    Terms & ConditionsAccessibility statement