NTLM – Authenticate NTLM at Reverse Proxy for Unauthenticated Web Servers

haproxyiisnginxntlmreverse-proxy

I have several Linux HTTP servers setup with no authentication required to access the web content. I would like for my Windows users to be able to access these sites with pass-through authentication.

I don't want to have to try and set this up on every web server though. My idea is that I could NTLM authenticate them at a reverse proxy and then the proxy could make the unauthenticated request and the web servers would only accept connections from said reverse proxy. Ideally I would be able to restrict access to certain sites/urls based on the users AD group but that is not a requirement.

Most examples/tutorials I have come across in searching are about proxying the credentials all the way to the destination web server but I want the proxy to do the authentication itself. I'm fine with running the proxy in Windows if I need. Whatever is easiest to setup is what I'm looking for.

Best Answer

I ended up with 2 viable solutions to this problem. Hopefully this will be helpful to anyone trying to setup something similar.

Set up IIS with ARR (Application Request Routing) and enable Windows authentication globally. Then, configure a global authorization rule to allow whichever users you want to be able to authenticate through the reverse proxy. The downsides to this method were that you can't easily set different permissions to different sites if you're proxying more than one. You can specify a "location path" in a URL authorization rule but you can't say server1 allow these users server2 allow these users.

The option I chose to use was running Apache 2.4 w/ a newer NTLM plugin I found on Github (https://github.com/TQsoft-GmbH/mod_authn_ntlm). I didn't come across any drawbacks using this method. Config below.

<VirtualHost *:*>
  ProxyPass / http://server1/
  ProxyPassReverse / http://server1

  ServerName proxy1

  <Location /* >
    AuthType SSPI
    NTLMAuth On
    NTLMAuthoritative On
    NTLMOfferBasic On
    <RequireAny>
      Require sspi-user contoso\johnsmith
    </RequireAny>
  </Location>
</VirtualHost>

<VirtualHost *:*>
  ProxyPass / http://server2/
  ProxyPassReverse / http://server2

  ServerName proxy2

  <Location /* >
    AuthType SSPI
    NTLMAuth On
    NTLMAuthoritative On
    NTLMOfferBasic On
    <RequireAny>
      Require sspi-group "contoso\Domain Users"
    </RequireAny>
  </Location>
</VirtualHost>

Related Solutions

Reverse proxy setup in ISA Server

You should be able to do that using different subfolders in your web publishing rules.

This Microsoft TechNet article explains the details and has some walk-throughs for ISA Server 2004:

Web publishing provides you detailed control over access to content. Web publishing rules are rich in features, including the following:

Mapping requests to specific internal paths. You can limit the portions of your servers that can be accessed.

Restricting access to specific users, computers, or networks. You can restrict access, to further improve security.

Requiring user authentication. User authentication can be passed through to the Web server, eliminating the need to reauthenticate at the Web server.

Providing link translation. You can handle links to internal servers.

Providing SSL bridging. You can encrypt traffic between the ISA Server computer and the Web server.

Search for this section:

Publishing Web server folders on the Internal or perimeter network to one domain name

You can publish specific folders on a Web server on the Internal network or on a perimeter network. In this scenario, both folders are published to the same domain. For example, you want to publish the \news folder to www.fabrikam.com/news, and the \updates folder to www.fabrikam.com/updates.

For ISA Server 2006 there is this article (or as Word file here), which explains the options you have for publishing. Search for "Web Publishing Rule Properties" and "Path Mapping" inside the document.

NGINX Reverse Proxy – URL Rewrite

Any redirect to localhost doesn't make sense from a remote system (e.g. client's Web browser). So the rewrite flags permanent (301) or redirect (302) are not usable in your case.

Please try following setup using a transparent rewrite rule:

location  /foo {
  rewrite /foo/(.*) /$1  break;
  proxy_pass         http://localhost:3200;
  proxy_redirect     off;
  proxy_set_header   Host $host;
}

Use curl -i to test your rewrites. A very subtle change to the rule can cause nginx to perform a redirect.

Best Answer

Related Solutions

Reverse proxy setup in ISA Server

NGINX Reverse Proxy – URL Rewrite

Related Topic