Support NTLM authentication against Windows 2012 RD Gateway on iOS/Android

iOS/Android clients use only Basic authentication against Windows 2012 RD Gateway (HTTP transport), while it provides more secure options like NTLM. Both Windows and Mac clients use NTLM in that case.

Hi,
For this you can specify the policy setting for “RD Gateway authentication mode” under below path.
User Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\RD Gateway
In addition you can refer beneath article if find helpful in your case.
Remote Desktop Gateway client fails authentication with “Your user account is not authorized to access the RD Gateway”
http://blogs.technet.com/b/networking/archive/2010/01/14/remote-desktop-gateway-client-fails-authentication-with-your-user-account-is-not-authorized-to-access-the-rd-gateway.aspx
Hope it helps!
Thanks.
Dharmesh Solanki
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Similar Messages

Authenticator not being invoked - NTLM authentication against IIS 6.0 !!

Hi Folks,
I am trying to access Microsoft Reporting Service running on IIS 6.0 through a Web Proxy (a simple application running in an App Server) using the NTLM authentication. This is what i am doing
Authenticator.setDefault(new ReportAuthenticator());
HttpURLConnection urlConnection = (HttpURLConnection) url.openConnection();.
As i understand, the authentication is to magically work with the IIS Server requesting my web proxy for the credentials on connect whcih should involke the Authenticaor class.
Howver this is not happening at the moment. The authenticator object never gets invoked and even then my web proxy is being able to chat to IIS. The Sun app server hosting my web proxy is somehow passing my windows credentials to IIS and since my account has sufficient previliges on IIS, i am able to get through the initial connection.
When i debug the urlConnection object, i can see that the connection recognises that this is an NTLM authentication but is obviously not using the Authenticator credentials.
Is the Authenticator object meant to be invoked automatically or do i need to set some header information in the urlConnection??
Any help is greatly appreciated.
P.S: I am using JDK 1.5, IIS 6.0, Sun App Server 9.0 (platform edition)
best regards
Dushy

Hi,
we had the same problem, but we got support
from readme.txt
Bug#: 6789020
Agent type: All Agents
Description: In CDSSO mode non enforced POST requests cannot be accessed
Bug#: 6736820
Agent type: IIS 6 Agent
Description: IIS 6 agent doesn't work properly with ASP pages in CDSSO mode
Both bugs should be fixed in this version:
Sun Java System Web Agents 2.2-02 hotpatch2

ISE and authenticating against Windows AD with RADIUS realm that is different from the Windows domain

Hello
We are in the process of evaluating the Cisco ISE VMWare appliance with a view to replace our existing FreeRADIUS installation as authentication provider for our wireless network and VPN service. As a part of this we are hoping to migrate our user authentication to Microsoft Active Directory - we have previously authenticated against a different identity store (not MS AD). Because of this legacy our Windows domain is not the same as our RADIUS realm name - the Windows domain is "win.mydomain" whereas we wish to allow users to authenticate using "username@mydomain" or even "[email protected]" as they are doing today. We are experiencing an issue where authentication requests with the format "[email protected]" will be forwarded to the Windows AD whereas authentication requests with the format "username@mydomain" will fail with the log message "User not found in Active Directory". We do not know if the ISE itself is validating the username and triggering this error, or if the error originates from AD. We suspect the that the ISE is not even asking AD because "win.mydomain" is the domain configured in "Active Directory" in "External Identity Sources".
Authentication requests against the AD without a realm are successful (that is, using only "username"). With this in mind we located a post on the Cisco support forums that described a process of proxying the request back to the ISE and strip the realm information, but this was specific for the ACS platform. We have attempted to implement this solution but it is still not working as we would have hoped, and we are not entirely certain where the fault might lie. We are currently using PEAP with MSCHAPv2 for authentication in our WLAN where the main problem is. We suspect that the "proxy-to-self" with realm stripping is an issue with PEAP.
Is there a supported method of achieving our goal, or should we abandon the ISE platform as our scenario is simply not supported?

Seems like your issue maybe related to DNS, when ISE receives the format [email protected], the dns request is failing. However, there is a setting for alternate UPN Suffixes that can be configured to include domain.com and student.domain.com.
Here is a windows article that should fix this for you. Once you get this updated please reboot ISE so it rejoins AD. Try your tests again.
http://technet.microsoft.com/en-us/library/cc772007.aspx
Thanks,
Tarik Admani
*Please rate helpful posts*

Cross Domain authentication between Windows 2012 R2 domains

Hello,
I am trying to figure out if this is possible.
We have 2 companies that have a VPN between them.
I can ping their PCs and access their servers by name no issues.
What I am trying to do is setup a cross domain authentication.
So their credentials can be authenticated without creating an account for them on a local network. (and vise versa)
This way on our domain I can create share and they will be able to access it without needing to logon without different credentials.
Thank you.

We have Meraki with Site to Site VPN.
Site-to-site firewall
Policy
Protocol
Source
Src port
Destination
Dst port
Comment
Actions
<tfoot>
Allow
Any
Any
Any
Any
Any
Default rule
</tfoot>
Add a rule
So as you can tell we don't block anything at all.

Re: How to enable NTLM authentication in OSB???

Hi all,
We have the same problem trying to integrate OSB with and asmx service that uses NTLM.
We try an alternative, we have created the artifacts of asmx service using wsimport and we created a little java project using these artifacts. We also added a class with a static method in this project in order to be used by OSB java callout mechanism. When this project if used standalone (through eclipse) works fine and as the environment is windows server, it sends automatically to the client the credentials of user that is logged on windows domain. On the other hand when we deploy this java project in OSB as jar for callout we receive : Response: '401: Unauthorized' exactly at the point that the produced artifact class invokes the constructor of javax.xml.ws.Service in order to create an instance of the service.
Can it be the same problem stated by 830428?
The stack trace:
com.sun.xml.ws.wsdl.parser.RuntimeWSDLParser.tryWithMex(RuntimeWSDLParser.java:172),
com.sun.xml.ws.wsdl.parser.RuntimeWSDLParser.parse(RuntimeWSDLParser.java:153),
com.sun.xml.ws.client.WSServiceDelegate.parseWSDL(WSServiceDelegate.java:284),
com.sun.xml.ws.client.WSServiceDelegate.<init>(WSServiceDelegate.java:246),
com.sun.xml.ws.client.WSServiceDelegate.<init>(WSServiceDelegate.java:197),
com.sun.xml.ws.client.WSServiceDelegate.<init>(WSServiceDelegate.java:187),
weblogic.wsee.jaxws.spi.WLSServiceDelegate.<init>(WLSServiceDelegate.java:73),
weblogic.wsee.jaxws.spi.WLSProvider$ServiceDelegate.<init>(WLSProvider.java:515),
weblogic.wsee.jaxws.spi.WLSProvider.createServiceDelegate(WLSProvider.java:103),
weblogic.wsee.jaxws.spi.WLSProvider.createServiceDelegate(WLSProvider.java:95),
weblogic.wsee.jaxws.spi.WLSProvider.createServiceDelegate(WLSProvider.java:71),
javax.xml.ws.Service.<init>(Service.java:56),
org.tempuri.EDoc.<init>(EDoc.java:46),
after that (actually before) is just our code which calls the @WebServiceClient Class (the local artifacts which are used to call the actual web service).

Kuppusamy.V.,
We experiened the same issue as you and managed to find a solution to the problem.
The OSB does not support NTLM authentication, so you are quite correct in stating you must write a Java class and use a Java callout from an OSB Proxy Service.
Our Java class worked fine from the Unix commandline, but failed when deployed to the OSB and invoked by the proxy service with the dreaded '401 Unauthorised' error.
On closer inspection, the proxy service stack trace revealed:
java.io.FileNotFoundException: Response: '401: Unauthorized' for url: 'http://your.domain.here/default.aspx' at weblogic.net.http.HttpURLConnection.getInputStream(HttpURLConnection.java:474)
We noticed that the exception was being thrown from the WebLogic 'weblogic.net.http.HttpURLConnection' class and not the Sun 'java.net.HttpURLConnection' as we expected (and our Java code explicitly imported)!
We couldn't understand why a different HTTP handler was being invoked, but it got us thinking. And thinking. And raising an Oracle support ticket. And waiting.
Tired of waiting, we revisited the problem and chanced across the Javadoc for the 'java.net.URL' class and noticed one of the constructors allows you to specify a HTTP handler!
Instead of opening our URL with this typical usage:
URL url = new URL(yourURL);
HttpURLConnection http = (HttpURLConnection) url.openConnection();
We used:
URL url = new URL(null, yourURL, new sun.net.www.protocol.http.Handler());
HttpURLConnection http = (HttpURLConnection) url.openConnection();
And, hey presto!, it worked a treat.
And we closed the Oracle service ticket. And stopped waiting :)
Regards,
Jerome

ClassNotFound error when loading applet from a NTLM authenticated site

Hi,
I wrote a Java applet and put it into a JAR file and signed the JAR file. It works fine if the user doesn't need to be authenticated. However, when I place the same JAR to a site that uses NTLM (NT challenging) authentication. The applet failed to load and returns ClassNotFound exception. Does anyone know why?
The following is the complete error message:
java.io.IOException: Server returned HTTP response code: 401 for URL: http://unibox.MySite.com/fileupload/FileUpload.jar
     at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:697)
     at sun.plugin.net.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:369)
     at sun.net.www.protocol.http.HttpURLConnection.getHeaderFields(HttpURLConnection.java:1139)
     at sun.plugin.net.protocol.http.HttpURLConnection.checkCookieHeader(HttpURLConnection.java:330)
     at sun.plugin.net.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:367)
     at sun.plugin.net.protocol.http.HttpUtils.followRedirects(HttpUtils.java:39)
     at sun.plugin.cache.CachedJarLoader.download(CachedJarLoader.java:311)
     at sun.plugin.cache.CachedJarLoader.load(CachedJarLoader.java:131)
     at sun.plugin.cache.JarCache.get(JarCache.java:177)
     at sun.plugin.net.protocol.jar.CachedJarURLConnection.connect(CachedJarURLConnection.java:71)
     at sun.plugin.net.protocol.jar.CachedJarURLConnection.getJarFile(CachedJarURLConnection.java:56)
     at sun.misc.URLClassPath$JarLoader.getJarFile(URLClassPath.java:498)
     at sun.misc.URLClassPath$JarLoader.<init>(URLClassPath.java:459)
     at sun.misc.URLClassPath$2.run(URLClassPath.java:255)
     at java.security.AccessController.doPrivileged(Native Method)
     at sun.misc.URLClassPath.getLoader(URLClassPath.java:244)
     at sun.misc.URLClassPath.getLoader(URLClassPath.java:221)
     at sun.misc.URLClassPath.getResource(URLClassPath.java:134)
     at java.net.URLClassLoader$1.run(URLClassLoader.java:190)
     at java.security.AccessController.doPrivileged(Native Method)
     at java.net.URLClassLoader.findClass(URLClassLoader.java:186)
     at sun.applet.AppletClassLoader.findClass(AppletClassLoader.java:132)
     at sun.plugin.security.PluginClassLoader.findClass(PluginClassLoader.java:189)
     at java.lang.ClassLoader.loadClass(ClassLoader.java:306)
     at sun.applet.AppletClassLoader.loadClass(AppletClassLoader.java:112)
     at java.lang.ClassLoader.loadClass(ClassLoader.java:262)
     at sun.applet.AppletClassLoader.loadCode(AppletClassLoader.java:473)
     at sun.applet.AppletPanel.createApplet(AppletPanel.java:548)
     at sun.plugin.AppletViewer.createApplet(AppletViewer.java:1621)
     at sun.applet.AppletPanel.runLoader(AppletPanel.java:477)
     at sun.applet.AppletPanel.run(AppletPanel.java:290)
     at java.lang.Thread.run(Thread.java:536)
load: class FileUpload.class not found.
java.lang.ClassNotFoundException: FileUpload.class
     at sun.applet.AppletClassLoader.findClass(AppletClassLoader.java:151)
     at sun.plugin.security.PluginClassLoader.findClass(PluginClassLoader.java:189)
     at java.lang.ClassLoader.loadClass(ClassLoader.java:306)
     at sun.applet.AppletClassLoader.loadClass(AppletClassLoader.java:112)
     at java.lang.ClassLoader.loadClass(ClassLoader.java:262)
     at sun.applet.AppletClassLoader.loadCode(AppletClassLoader.java:478)
     at sun.applet.AppletPanel.createApplet(AppletPanel.java:548)
     at sun.plugin.AppletViewer.createApplet(AppletViewer.java:1621)
     at sun.applet.AppletPanel.runLoader(AppletPanel.java:477)
     at sun.applet.AppletPanel.run(AppletPanel.java:290)
     at java.lang.Thread.run(Thread.java:536)
Caused by: java.io.IOException: open HTTP connection failed.
     at sun.applet.AppletClassLoader.getBytes(AppletClassLoader.java:224)
     at sun.applet.AppletClassLoader.access$100(AppletClassLoader.java:40)
     at sun.applet.AppletClassLoader$1.run(AppletClassLoader.java:141)
     at java.security.AccessController.doPrivileged(Native Method)
     at sun.applet.AppletClassLoader.findClass(AppletClassLoader.java:138)
     ... 10 more

It appears that the latest jvm plugins use java to get the archive files instead of using the browser to download the archive files.
In addition sun does not support NTLM authentication, because of this the latest jvms are unable to download the jar file containing the applet.
I have been working on finding a way to replace suns http Handler, but have had no luck with setting the java.protocol.handler.pkgs for the plugin and having it retain the setting.
I have achieved partial results using the appletviewer with -J-Djava.protocol.handler=com.nogoop
you might try taking a look at http://www.nogoop.com

OSB NTLM authentication

Hi.
I'm looking for any example to create a passthrougth proxy service on a business service based on an endpoint HTTP that requires basic authentication plus NTLM domain.
I haven't OWSM on this OSB.
TIA
Corrado

Corrado,
FYI, NTLM is no longer recommended -
http://msdn.microsoft.com/en-us/library/cc236715.aspx
http://en.wikipedia.org/wiki/NTLM
Now coming to your question, OSB does not support NTLM authentication mechanism. As a workaround, you may write a java client that can support NTLM authentication over HTTP and then use this as a java callout in your proxy. You may pass the incoming authentication info to the java callout which may perform the further work (authentication and service invoke)
Regards,
Anuj

TS140 install Windows 2012 on RAID 1

Hello, I'm planning to install a Windows 2012 Server on a TS140 using RAID 1 configuration. As I read in the manuals, RAID is most often used with CSM (Compatibility Support Module), but as Windows 2012 supports UEFI it could be used with drivers.Which one is the recommended configurarion?Besides installing the driver are any drawbacks in any configuration? Thanks in advance,Pablo Moleri

Yes, I'm booting from DVD.
Yes, I have CSM Enabled but didn't know about Boot Priority, so I'm using
the default, which in my case caused the TS140 to fail, that is it didn't
see the RAID drives.
Problem installing Windows Server 2012 R2 on partition > 2.2 TB, see
https://support.microsoft.com/en-us/kb/2604034 - Error 0x80042468 received
when creating a single partition on drive greater than 2.2TB during install
of Windows
So in a nutshell, your saying TS140 RAID can boot with UEFI enabled, I just
need to change the boot priority to what?
thanks,
Jeff Jensen

Lync 2013 Authenticating with Windows Account Every Minute

Seeing a strange issue with Lync 2013 client logging into my Windows Account about every 1-2 minutes. We are using Lync Server 2013 (on-premise) so it makes no sense that it is logging into and authenticating against Windows Account. This was causing major
issues as my Windows Account password was different than my company domain login. This was causing Lync to use the "wrong" password to login into Windows Account. I changed the passwords to match and now still seeing Lync logging in constantly
into Windows Account.
This is adding up to a LOT of data traffic. Lync should NOT be authenticating every 1-2 minutes into my Windows (Live) Account. Help please!

Hi,
Did the issue happen only for you or for multiple users?
Please exist Lync client, delete user profile on local computer with the following path, then restart Lync client:
%UserProfile%\AppData\Local\Microsoft\Office\15.0\Lync
Best Regards,
Eason Huang
Eason Huang
TechNet Community Support

Prerequisites for Using Windows NTLM Authentication

Hi,
One of the prerequisites for using Windows NTLM Authentication, mentioned on help.sap.com documentation, is:
- The users Web browser must be a Microsoft Internet Explorer
This means that users not using Internet Explorer cant authenticate using other web browser (Firefox and Netscape).
In PAM, SAP says that web browser based on mozzila 1.7.x is also supported, and from this version on, Firefox and Netscape, both, support NTLM.
NTLM Authentication in portal, still be supported with IE web browser?
Thanks and Regards,
Paul

Hi Paul,
I suspect that although it may not be officially supported, it will work. The main thing is that a frontend web server perform the NTLM authentication and pass the header variable back to the J2EE engine. By the time the header gets back to the J2EE engine, I dont think the portal has any idea how the header REMOTE_USER was generated, just that it was.
Not positive though, as I havent tested the scenario you describe below..just thought I'd throw in my two cents.
Marty

Issue using Flash IDE with Mac OS and Windows Web Service using NTLM authentication?

I have an existing application that I developed on a Windows machine using CS5. It uses a local intranet web service written in .NET using NTLM authentication. The web service does multiple things such as read data from an SQL database, provide the user's username, and test for write/read access to a local company fileshare. When my company upgraded, I went to a Mac with Flash CC which is great. However, Mac's don't handle HTTP Authorization Challenge Blocks like Windows machines. In Safari, Chrome, etc. it will pop up a little username and password box and proceed on without issue. The issue is in Flash development. When running the exact same application in Flash testing all script access fails with HTTP Status 401 errors. I have searched the AS3 documentation, but the only thing built in to handle http challenge requests is in AIR not Flash. The server admin's and I have tried all method's of cross domain policy files and access changes with no luck at all. Does anyone have a solution to this issue?

Did you check Apple Support Boot Camp article?
iMac displays a black screen during installation of Windows 7
http://www.apple.com/support/bootcamp/
Installation Guide
Instructions for all features and settings.
Boot Camp FAQGet answers to commonly asked Boot Camp questions.
Windows 7 FAQAnswers to commonly asked Windows 7 questions.

Is SharePoint 2010 Supported on Windows 2012 R2

Hi
I have read Trevor Seward's responses to various questions on this subject :-
http://social.technet.microsoft.com/Forums/en-US/ad4e17ee-83de-41d6-a974-244ceccb8a63/is-sharepoint-2010-sp1-is-supported-by-windows-server-2012-currently-i-have-os-version-of-server?forum=sharepointadminprevious
http://social.technet.microsoft.com/Forums/en-US/e7539d34-aaa2-4d9c-a44c-e65d388d8944/support-for-sharepoint-foundation-2010-on-windows-server-2012-r2?forum=sharepointadminprevious
However, we have a farm which is currently SP2010 SP1 which we are about to upgrade to SP2010 SP2 running on Windows Server 2008R2 and SQL Server 2008 R2. So the farm is currently not supported by Microsoft.
We are now looking to upgrade this farm to SP2013 SP1 running Windows Server 2012 R2 and SQL Server 2012.
We plan to start this process of by upgrading Windows Server 2008 R2 to Windows Server 2012 R2.
Will SharePoint 2010 SP2 run on Windows 2012 R2 (or will we need Windows 2012) ?
Once Server 2012 R2 (or Server 2012) is up and running, we will upgrade SP2010 SP2 to Sp2013 SP1.
Finally upgrade SQL Server 2008R2 to SQL Server 2012.
So the part I don't know is will SharePoint 2010 SP2 run on Windows 2012 R2 or Windows 2012 ?
Thanks
Nigel
Nigel Price NJPEnterprises

Not a question for the Windows Server people. This is a question for the SharePoint people. You may want to try asking in a SharePoint forum like
http://social.technet.microsoft.com/Forums/en-US/home?forum=sharepointadminprevious
. : | : . : | : . tim

Lync 2010 Voice & Video Support on Windows 2012 R2 SP1 RDSH & RDVH

Hello - We have successfully demonstrated RDSH & RDVH using Windows 2012 R2, Windows 8 virtual desktops and Dell T10 Zero clients. RemoteFX has been successfully tested as well for Printing across RDSH & RDVH environments.
Problem at hand is that we are unable to showcase Lync 2010 Voice & Video calling across both these environments (RDSH & RDVH).
RDSH Environment
In an RDSH environment, we observe that a Platronics headset connected to the Dell T10 thin client is able to get redirected to the RDSH Server using RemoteFX and in-turn the RDSH Server is able to detect the connected hardware. However, the Lync 2010 client,
published using RDSH, is UNABLE to detect the connected audio device.
As for Logitech Webcam connected to the Dell T10 thin client, we have no issues with device detection and the Lync 2010 client is able to see the connected Webcam device.
RDVH Environment (Pooled Desktop)
As for the RDVH environment, we observe that both the Platronics headset & Logitec Webcam connected to the the Dell T10 thin client are UNABLE to get redirected to the RDVH Server using RemoteFX. We have enabled RemoteFX via Group policy in this environment.
Queries:
A. Could you help providing some direction into troubleshooting/isolating the audio-device detection issue on Lync clients in an RDSH environment.
B. Could you help providing some direction into troubleshooting/isolating the audio & webcam re-direction issue in an RDVH environment. FYI, our test bed server does NOT support GPU and wanted to check if that would be a limitation towards detection
of these devices?
Thanks
Srinath
sgopalkr

Hi Dharmesh,
Thank you for a response.
We had already enabled Audio and Video playback option.
But when we have tested with windows 7 desktop machine, the audio devices are detecting in Lync client in both RDVH and RDSH
environment and we are able to make audio calls. So we are planning to test with the different thin clients. Post we will update the same.
Thanks.
Manikandan

LYNC 2010 on Supportability on Windows 2012 R2

Is it possible to run Lync server 2010 on Windows server 2012 R2?
Is there any known issues running LYNC 2010 Enterprise pool with Enterprise Voice on Windows 2012 R2 OS?
Any special requirements or issues installing LYNC 2010 on Windows 2012 R2?
We have one pool on Windows 2008 R2, would like to add additional pool with Windows 2012 R2.
Thanks in Advnace
Tek-Nerd

Per the following URL:
http://technet.microsoft.com/en-us/library/gg412883(v=ocs.14).aspx
Microsoft does not support this on operating systems that are not listed on this page for Lync 2010. Windows Server 2012 (and R2) are not listed as supported.
There are several new features in Server2012 that are not used in Lync 2010. I would not install 4 year old enterprise software on a platform such as Server 2012 R2. There are enough hoops to jump through with Lync 2013.
if my post is helpful - please click on the green arrow. (please excuse, in advance, any perceived sarcasm/humor - as I often forget it does not translate through text) :)

Microsoft SharePoint Foundation 2010 Supports Windows 2012 R2 ?

Hello,
I have a requirement to install Self Service Portal on one dedicated Server and found that Both the Web Content Server and SharePoint Web Parts on One Computer. I want to use Microsoft Sharepoint 2010 Foundation Server as it is free.
My query is this - Does Microsoft SharePoint 2010 supports Windows 2012 R2 OS.
Below link has a details till Windows 2012 Server but not with Windows 2012 R2
http://www.microsoft.com/en-in/download/details.aspx?id=24983
Please answer.
Thanks,
Ankur

HI,
for installing SharePoint Server 2010 Fondation on Windows Server 2012 R2 Version, you Need the SP2 for SharePoint fondation.
for confirmation see this link:
https://support.microsoft.com/kb/2724471/?wa=wsignin1.0
thanks
diramoh

Support NTLM authentication against Windows 2012 RD Gateway on iOS/Android

Similar Messages

Maybe you are looking for