New Member

Question

ntlm and authentication page

Forum|Forum|11 years ago
May 25, 2015
9 replies
20672 views

I am working on FortiOS 5.2.3 ( latest one) and have configured SSO on it . Now I wanted computers which are not a part of domain to be prompted for a user/pass login page when they try to access the internet. For this I configured "set ntlm enable" and "set ntlm-guest enable" command under the firewall policy .

When I try to access the internet a popup will show up asking for user/pass , once I put the domain user pass it will get auehtnciated and internet will work. In fortigate user section that user will also show up as NTLM based authentication.

THe only problem here is that I want to avoid the popup and want that fortigate login page instead. I thought this might be some browser problem so i tried IE , chrome and firefox and on all same thing comes up and not a login page.

Please guide how to get the login page instead of the popup

xsilver_FTNT

Staff

I'm afraid that NTLM will always cause web browser to trigger login pop-up window and not a web form.

If you want to have customized form based authentication page (ala standard web page with login form), then the only way is explicit proxy and its policy, with IP based you would be able to choose primary auth method (pasive) as FSSO, and secondary (active authentication which does require user interaction) as Form based, and then you can customize replacement messages to tune-up login form.

Note that explicit proxy does slow down the overall throughput, as it's proxy. So form based logon possibility has its price.

ciscomemoAuthor

New Member

xsilver wrote:
I'm afraid that NTLM will always cause web browser to trigger login pop-up window and not a web form.

If you want to have customized form based authentication page (ala standard web page with login form), then the only way is explicit proxy and its policy, with IP based you would be able to choose primary auth method (pasive) as FSSO, and secondary (active authentication which does require user interaction) as Form based, and then you can customize replacement messages to tune-up login form.
Note that explicit proxy does slow down the overall throughput, as it's proxy. So form based logon possibility has its price.

can you please share config for this

xsilver_FTNT

Staff

If you are asking for config of explicit proxy then there is nothing special, just standard config gives you those opportunities, check FortiGate GUI for explicit proxy firewall policy or docs.fortinet.com site for guides.

rezendecs

New Member

I hope that this answer still can help you!!!!

Look the link bellow.

https://www.linkedin.com/grp/post/1769457-5919733185838600193

Regards,

Claudio

Wurstsalat

Explorer

NTLM is never a loginpage...it is send from the client so it will always this popup.

But dont ask me how to get the Login page...i will use/test this only in the near future (never used it before) ;)

rwpatterson

New Member

When I dealt with NTLM way in the past, it only passed through with IE. Other browsers presented a web dialogue due to the lack of Active X, I believe...

Wurstsalat

Explorer

Chrome should understand NTLM by default

Firefox has to be configured for NTLM (have a look at about:config + search for ntlm)

This is not cause of the lack of any active x stuff

Sign up

Login with SSO

Login to the community

Login with SSO