Here is my study case:

browser ---> apache proxy ---> ISA server ---> internet

The ISA server requires an authentication.

The issue is to allow HTTPS through the two proxies.

A configuration that works with HTTP is something like this: (yes, I don't want to use ProxyPass but ProxyRequests)

<virtualhost *:8080>
 SetEnv auth-proxy-chain on
 ProxyRequests On
 ProxyRemote * http://isaproxy:80
 <proxy *>
  AuthName "ISA server auth"
  AuthType Basic
  [here a module to authenticate]
  require valid-user
  Allow from all

The user can authenticate on the apache proxy then the authentication chain is sent to the ISA server that allows the HTTP trafic.

But, while the browser switchs to HTTPS, the ISA server "speaks" NTLM and breaks the authentication on the apache proxy.

If I try to use the SSPI module (ntlm) with something like this:


  <proxy *>
    AuthName "ISA server auth"
    AuthType ntlm
    [ SSPI stuff ]
    Require valid-user
    Allow from all

The apache server reject the authentication (or the ISA server I don't really know).

I use wireshark to look at the nominal process while using directly the ISA server as proxy. The first auth-chain is a BASIC type then it switchs to NTLM (and the challenge continues with NTLM).

How should I configure apache that it transfers the NTLM authentication to the ISA proxy without checking it(*)? Or to rewrite headers to force BASIC authentication?

(*) It seems not to be as easy as it seems...

  • Why are you using ProxyRequests? Why are you authenticating on the Apache server at all? – Shane Madden Dec 30 '11 at 17:17
  • I just want to use apache as a forward proxy. If I don't put some authentication on the apache server I can't forward user auth to the ISA server; Or do i miss something ? – trotzim Jan 2 '12 at 14:07

If you don't do authentication on the proxy, then the normal authentication process will happen between the ISA server and the client.

If that would work for you, then that's the suggestion that I'd make; there's really no way to double-authenticate in the same headers to both different servers unless the servers are both doing basic authentication with the same credentials.

  • I know that, but the normal authentication process do not happen, apache seems to not forward the authentication query and so the ISA server reply a 407 error. I have sthing like this: 1) browser (hhtp query) ---> Apache ---> ISA 2) ISA (auth request) ---> Apache -X-> browser – trotzim Jan 3 '12 at 9:07
  • The 407 is the proxy telling the client to authenticate.. – Shane Madden Jan 3 '12 at 16:06
  • 1
    Is there a way to force basic authentication ? – trotzim Jan 3 '12 at 21:57
  • Did you ever get this figured out – TimWickstrom.com Apr 6 '12 at 19:58

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.