0

I'm trying to set Apache as proxy server to an internal SharePoint server.

I have previously configured Apache to run as a proxy server to export internal webpages and web applications.

However, the Sharepoint is using SSL and NTLM authentication, and this is new to me :(

I have tried many options, the traffic seems to be forwared as I get the authentication popup window, but when I insert the user/pass, I get back to the same popup window.

Anybody has configured Apache to do so?

Here is a part of my httpd.conf:

<VirtualHost *:443>
    ServerName repository.out.com

    SSLProxyEngine On
    RequestHeader set Front-End-Https "On"

    ProxyRequests Off
    ProxyPreserveHost On
    ProxyPass / https://sharepoint.in.com
    ProxyPassReverse / https://sharepoint.in.com

    CacheDisable *

    SetEnv force-proxy-request-1.0 1 
    SetEnv proxy-nokeepalive 1

    ErrorLog logs/jlanza_log
    CustomLog logs/jlanza_log common
</VirtualHost>
Improve this question
2
  • You'll need the ntlm_auth module; I'm not familiar with it enough to provide instructions.
    – Chris S
    Aug 4, 2010 at 15:29
  • I thought ntlm_auth was to enable NTLM authentication to apache. What I want is to forward the authentication from the internal server to the client through the proxy.
    – jlanza
    Aug 5, 2010 at 14:01

4 Answers 4

Reset to default
4

NTLM was not designed to work through Proxies (or in your case: reverse-proxies).

As with a single proxy, inserting a reverse proxy will cause NTLM authentication between the client browser and the Web server to cease functioning

(see http://support.microsoft.com/kb/198116/en-us)

However, there are workarounds:

  • In your case (where SSL is used) the module mod_proxy_connect might provide a solution, since it doesn't seem to terminate the http session on the reverse proxy.
  • I know that recent Versions of squid use a feature called "connection-pinning" to Proxy NTLM. I'm not sure if apache has a similar feature. You could just use squid instead of apache...
  • You might also want to consider changing some of the default values in Firefox to make NTLM work (see about:config -> apply Filter "NTLM")
  • Apart from that, changing the Authentication from NTLM to BASIC will probably solve all your problems. Since you are using SSL you won't even have to worry about someone sniffing your Passwords while using Basic_Auth.
Improve this answer
0

You can consider to installing mod_ntlm and configure it using NTLMv2 auth directly to your AD. Then the proxy will authenticate the session to active directory and will setup a connection to sharepoint. There will be a double authentication request, so you need to check if when you're authorized by the proxy.. the cookie will authenticate you for the sharepoint server.. for that im not sure since i've never tested it.

Good Luck

WiNC

Improve this answer
0

I have faced the same NTLM Apache/2.4.6 (CentOS) the frquent NTLm popup window even after entering correct user details.

The issue was resolved by loading module LoadModule mpm_prefork_module modules/mod_mpm_prefork.so instead of LoadModule mpm_worker_module modules/mod_mpm_worker.so

Improve this answer
-1

I have this same problem on the 2.2.3 version included in Centos5

IMHO it is this bug https://issues.apache.org/bugzilla/show_bug.cgi?id=39673

I found no solution, nor a workaround: I decided to use an old apache (1.3.something?) that works.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .