Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to set Apache as proxy server to an internal SharePoint server.

I have previously configured Apache to run as a proxy server to export internal webpages and web applications.

However, the Sharepoint is using SSL and NTLM authentication, and this is new to me :(

I have tried many options, the traffic seems to be forwared as I get the authentication popup window, but when I insert the user/pass, I get back to the same popup window.

Anybody has configured Apache to do so?

Here is a part of my httpd.conf:

<VirtualHost *:443>
    ServerName repository.out.com

    SSLProxyEngine On
    RequestHeader set Front-End-Https "On"

    ProxyRequests Off
    ProxyPreserveHost On
    ProxyPass / https://sharepoint.in.com
    ProxyPassReverse / https://sharepoint.in.com

    CacheDisable *

    SetEnv force-proxy-request-1.0 1 
    SetEnv proxy-nokeepalive 1

    ErrorLog logs/jlanza_log
    CustomLog logs/jlanza_log common
</VirtualHost>
share|improve this question
    
You'll need the ntlm_auth module; I'm not familiar with it enough to provide instructions. –  Chris S Aug 4 '10 at 15:29
    
I thought ntlm_auth was to enable NTLM authentication to apache. What I want is to forward the authentication from the internal server to the client through the proxy. –  user50211 Aug 5 '10 at 14:01
add comment

3 Answers 3

NTLM was not designed to work through Proxies (or in your case: reverse-proxies).

As with a single proxy, inserting a reverse proxy will cause NTLM authentication between the client browser and the Web server to cease functioning

(see http://support.microsoft.com/kb/198116/en-us)

However, there are workarounds:

  • In your case (where SSL is used) the module mod_proxy_connect might provide a solution, since it doesn't seem to terminate the http session on the reverse proxy.
  • I know that recent Versions of squid use a feature called "connection-pinning" to Proxy NTLM. I'm not sure if apache has a similar feature. You could just use squid instead of apache...
  • You might also want to consider changing some of the default values in Firefox to make NTLM work (see about:config -> apply Filter "NTLM")
  • Apart from that, changing the Authentication from NTLM to BASIC will probably solve all your problems. Since you are using SSL you won't even have to worry about someone sniffing your Passwords while using Basic_Auth.
share|improve this answer
add comment

I have this same problem on the 2.2.3 version included in Centos5

IMHO it is this bug https://issues.apache.org/bugzilla/show_bug.cgi?id=39673

I found no solution, nor a workaround: I decided to use an old apache (1.3.something?) that works.

share|improve this answer
add comment

You can consider to installing mod_ntlm and configure it using NTLMv2 auth directly to your AD. Then the proxy will authenticate the session to active directory and will setup a connection to sharepoint. There will be a double authentication request, so you need to check if when you're authorized by the proxy.. the cookie will authenticate you for the sharepoint server.. for that im not sure since i've never tested it.

Good Luck

WiNC

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.