Learn F5 Technologies, Get Answers & Share Community Solutions Join DevCentral

Filter by:
  • Solution
  • Technology

APM - proxy NTLMv1 client side auth to NTLMv2 server side


I've been asked if the F5 can proxy a request between a client that supports NTLMv1 and a server that currently supports NTLMv2.

My understanding of the NTLMv2 SSO Configuration is that it expects the client password to be known, and it uses that in combination with the username and domain to generate the NTLM token to be sent to the server.

Can the F5 pull the password out of an NTLM token sent by the client? I had a look at a session dump of an NTLM authenticated client side connection, but couldn't see a session variable for it.

I suspect my options are:

  1. Set the password using a variable assign in the access profile (client connecting is using a service account so the password doesn't change) but that's not ideal
  2. See if the server can be configured to support Kerberos and then setup a kerberos SSO configuration to authenticate server side

Appreciate any thoughts or suggestions

Cheers, Simon

Rate this Question

Answers to this Question


This is not possible with any product to proxy ntlm auth.

When client authenticate with ntlm on any server, it doesn’t receive the password -—> it can’t authenticate with password on server side.

The server side authentication must be password less like Kerberos sso.

Comments on this Answer
Comment made 12-Jan-2018 by Simon 230

Thanks, Stanislas

I was expecting that to be the case. I’ll see if the server can be configured for Kerberos.