I've been asked if the F5 can proxy a request between a client that supports NTLMv1 and a server that currently supports NTLMv2.
My understanding of the NTLMv2 SSO Configuration is that it expects the client password to be known, and it uses that in combination with the username and domain to generate the NTLM token to be sent to the server.
Can the F5 pull the password out of an NTLM token sent by the client? I had a look at a session dump of an NTLM authenticated client side connection, but couldn't see a session variable for it.
I suspect my options are:
Appreciate any thoughts or suggestions
This is not possible with any product to proxy ntlm auth.
When client authenticate with ntlm on any server, it doesn’t receive the password -—> it can’t authenticate with password on server side.
The server side authentication must be password less like Kerberos sso.
I was expecting that to be the case. I’ll see if the server can be configured for Kerberos.