NT LAN Manager (NTLM) performs authentication using a multiple-exchange, encrypted challenge-and-response sequence between NetCache and a Microsoft Windows domain controller. You can enable NTLM for either Microsoft Windows NT or Microsoft Windows 2000 domain access to the Microsoft Windows authentication environment.
For true NTLM requests--those coming from Microsoft Internet Explorer and not clear-text NTLM requests coming from another browser, such as Netscape--each authentication exchange is different. A unique challenge is posed to the browser on each connection, and the NetCache appliance does not discover the user's password.
The NTLM challenge-response handshake entails three requests and responses. These exchanges occur at the beginning of each browser-to-NetCache connection, before the data is delivered.
As it does for all authentication processes, the log file reflects the NTLM handshake process, showing three GET requests. Because they are similar, these entries can confuse log viewers.
Each intermediate GET request from the client is logged as generating a 403 authorization response from the appliance until the final OK response occurs. The appliance sends a 407 authorization message, which is noted as a 403 authorization message.
The NTLM handshake process log entries are written to the Web access log. These log entries contain information similar in content to that shown in the following example:
1019544846.91 0.079 10.53.50.76 TCP_HIT_ACCESS_DENIED/403 542 GET http://web.mycompany.com/~bohr/particle.txt - - "" AUTH_FAIL
1019544846.91 0.001 10.53.50.76 TCP_HIT_ACCESS_DENIED/403 619 GET http://web.mycomany.com/~bohr/particle.txt - - "" -
1019544846.92 0.030 10.53.50.76 TCP_MISS_PRIVATE/200 388 GET http://web.mycompany.com/~bohr/particle.txt administrator DIRECT/10.10.20.171 "text/plain" -
If the Domain Name Service (DNS) is not properly configured or if other Microsoft Windows domain configuration problems exist, the authentication process can result in failure causing the appliance to return an authentication failure message to Microsoft IE.
In response to that error, the Microsoft Internet Explorer browser might prompt the user for a user name and password to transmit to NetCache to persist in authentication. In this case, NetCache performs clear-text authentication, following the specified checking order sequence.
For clear-text NTLM requests (for example, those coming from a Netscape browser), the appliance converts the clear-text authentication information from the browser into NTLM format.
If a NetCache user's NTLM password expires and requires manual renewal, you can use the Expired Password URL option on the Authentication - General page to specify a URL that displays to the user the requirement to reset an expired password.
Early versions of Microsoft Internet Explorer prior to MSIE 5.5sp1 and MSIE 6, both of which in part fix the problem, cannot perform NTLM authentication with origin servers if, as clients, they are aware that a proxy server is involved in the process.
One solution to this problem is to use transparency so that the Microsoft Internet Explorer browser is unaware of the involvement of the NetCache.
To test whether NetCache is authenticating users using NTLM, use your browser to access a Web site you prefer.
If NetCache is configured correctly and you are using:
NTLM authenticates Microsoft Internet Explorer users to the Windows domain authentication database without requiring the user to enter user name and password information. In this document, this process is referred to as promptless authentication.
NTLM authenticates these users to the Windows domain, but they are required to reenter their user name and password information.
Copyright © 1994-2002, Network Appliance, Inc. All rights
reserved.
Part No. 210-00370
File: auth12.htm
Last updated: 11/12/02 11:23:17